huntrule

Windows Process Creation: wsl.exe Child Execution Outside Legitimate WSL Paths

Alert on System32 wsl.exe spawning a wsl.exe child process when the child path isn’t in known legitimate WSL locations.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2026-05-05
Updated
2026-10-03
AnalysisDetection
title: "Windows Process Creation: wsl.exe Child Execution Outside Legitimate WSL Paths"
id: 0c187a87-286e-404f-a870-682c578617ee
status: experimental
description: This rule flags cases where C:\Windows\System32\wsl.exe spawns a child process running an executable that ends with \wsl.exe. It then excludes events where the child wsl.exe matches common legitimate WSL install locations and package/WinSxS paths. This behavior matters because a modified WSL install path can cause proxy-style execution that still appears as wsl.exe activity from the expected System32 stub. The rule relies on Windows process creation telemetry with parent and image path fields.
references:
  - https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
  - https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
  - https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
  - https://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
  - https://learn.microsoft.com/en-us/windows/wsl/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wsl_binary_hijack_execution.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-05-05
tags:
  - attack.stealth
  - attack.t1036.005
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage: C:\Windows\System32\wsl.exe
    Image|endswith: \wsl.exe
  filter_main_legit_paths_1:
    Image:
      - C:\Windows\System32\wsl.exe
      - C:\Program Files\WSL\wsl.exe
  filter_main_legit_paths_2:
    Image|startswith:
      - C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_
      - C:\Windows\WinSxS\arm64_microsoft-windows-lxss-wsl_
      - C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux
  filter_main_legit_paths_3:
    Image|startswith: C:\Users\
    Image|contains: \AppData\Local\Microsoft\WindowsApps\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wsl_binary_hijack_execution/info.yml
license: DRL-1.1
related:
  - id: 88d306e9-8e2d-4025-9768-28757d2732db
    type: derived