Windows WSL Kali Linux installation via wsl.exe --install -i
Flags wsl.exe commands that install a distribution specified as Kali Linux using --install -i.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-10-10
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions where wsl.exe is invoked with arguments to install a Linux distribution and the command line includes the term 'kali'. Such activity matters because installing Kali Linux in WSL can provide an attacker with a ready penetration-testing toolset within a Windows environment. The detection relies on Windows process creation telemetry, matching the executable name/path characteristics for wsl.exe and specific command-line substrings (including the install flags and 'kali').
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows WSL Kali Linux installation via wsl.exe --install -i
id: 4e04619a-f4ad-495f-ac2e-6a23ce4dcfda
status: experimental
description: This rule identifies process executions where wsl.exe is invoked with arguments to install a Linux distribution and the command line includes the term 'kali'. Such activity matters because installing Kali Linux in WSL can provide an attacker with a ready penetration-testing toolset within a Windows environment. The detection relies on Windows process creation telemetry, matching the executable name/path characteristics for wsl.exe and specific command-line substrings (including the install flags and 'kali').
references:
- https://medium.com/@redfanatic7/running-kali-linux-on-windows-51ad95166e6e
- https://learn.microsoft.com/en-us/windows/wsl/install
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wsl_kali_linux_installation.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-10
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_wsl_img:
- Image|endswith: \wsl.exe
- OriginalFileName: wsl
selection_wsl_install:
CommandLine|contains:
- " --install "
- " -i "
selection_wsl_kali:
CommandLine|contains: kali
condition: all of selection_wsl_*
falsepositives:
- Legitimate installation or usage of Kali Linux WSL by administrators or security teams
level: high
license: DRL-1.1
related:
- id: eca8ae39-5c3c-4321-b538-9e64fe25822e
type: derived