Windows WSL Kali Linux installation via wsl.exe --install -i

title: Windows WSL Kali Linux installation via wsl.exe --install -i
id: 4e04619a-f4ad-495f-ac2e-6a23ce4dcfda
status: experimental
description: This rule identifies process executions where wsl.exe is invoked with arguments to install a Linux distribution and the command line includes the term 'kali'. Such activity matters because installing Kali Linux in WSL can provide an attacker with a ready penetration-testing toolset within a Windows environment. The detection relies on Windows process creation telemetry, matching the executable name/path characteristics for wsl.exe and specific command-line substrings (including the install flags and 'kali').
references:
  - https://medium.com/@redfanatic7/running-kali-linux-on-windows-51ad95166e6e
  - https://learn.microsoft.com/en-us/windows/wsl/install
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wsl_kali_linux_installation.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-10
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_wsl_img:
    - Image|endswith: \wsl.exe
    - OriginalFileName: wsl
  selection_wsl_install:
    CommandLine|contains:
      - " --install "
      - " -i "
  selection_wsl_kali:
    CommandLine|contains: kali
  condition: all of selection_wsl_*
falsepositives:
  - Legitimate installation or usage of Kali Linux WSL by administrators or security teams
level: high
license: DRL-1.1
related:
  - id: eca8ae39-5c3c-4321-b538-9e64fe25822e
    type: derived