Windows WSL Process Spawning Uncommon Child Executables

title: Windows WSL Process Spawning Uncommon Child Executables
id: fdafecf1-9cd3-4f4b-96d9-d01aced68cdc
related:
  - id: dec44ca7-61ad-493c-bfd7-8819c5faa09b
    type: derived
  - id: 2267fe65-0681-42ad-9a6d-46553d3f3480
    type: derived
status: test
description: This rule flags process creation events where a WSL-related parent process (wsl.exe or wslhost.exe) spawns a set of uncommon or suspicious child executables. Such activity matters because it can indicate stealthy execution paths and attempts to blend WSL-launched processes with other Windows tooling. The detection relies on Windows process creation telemetry, matching parent image endings and child image/path patterns consistent with temporary, public, or user-accessible locations.
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/
  - https://twitter.com/nas_bench/status/1535431474429808642
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wsl_child_processes_anomalies.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-23
modified: 2023-08-15
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - \wsl.exe
      - \wslhost.exe
  selection_children_images:
    Image|endswith:
      - \calc.exe
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \wscript.exe
  selection_children_paths:
    Image|contains:
      - \AppData\Local\Temp\
      - C:\Users\Public\
      - C:\Windows\Temp\
      - C:\Temp\
      - \Downloads\
      - \Desktop\
  condition: selection_parent and 1 of selection_children_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1