WSL Process Execution of Kali Linux on Windows

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1202Indirect Command Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows Subsystem for Linux activity related to Kali Linux by matching process image paths and names associated with Kali WSL distributions and executables. Attackers may use Kali within WSL to run reconnaissance, tooling, or follow-on commands from a Windows host while blending into legitimate development/admin environments. It relies on Windows process creation telemetry, specifically Image, ParentImage, and CommandLine fields that include Kali WSL paths and identifiers.

Reporting behind it

Related detections9 linkedT1202 — drag to rearrange

Windows SFTP.exe Indirect Command Execution via ProxyCommand

Windows vshadow.exe Proxy Execution via -exec Script/Command

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Windows Execution of Renamed NirCmd.exe (nircmd.exe/nircmdc.exe) via PE OriginalFileName

Windows: Detect renamed PingCastle binary execution via PE metadata and scanner command-line

Windows Process Creation: Execution of Renamed curl.exe via PE Metadata

Suspicious Child Process Creation from BgInfo.EXE on Windows

Windows Bash.exe Launched Without Script Execution Arguments

Windows: Office Executable Running a Document from Trusted Template/Startup Paths

WSL Process Execution of Kali Linux on Windows

Pivot detection · T1202 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

wsl-process-execution-of-kali-linux-on-windows-6f1a11aa

title: WSL Process Execution of Kali Linux on Windows
id: f9046ee0-eba9-4cb8-8592-460d56ce65eb
status: experimental
description: This rule identifies Windows Subsystem for Linux activity related to Kali Linux by matching process image paths and names associated with Kali WSL distributions and executables. Attackers may use Kali within WSL to run reconnaissance, tooling, or follow-on commands from a Windows host while blending into legitimate development/admin environments. It relies on Windows process creation telemetry, specifically Image, ParentImage, and CommandLine fields that include Kali WSL paths and identifiers.
references:
  - https://medium.com/@redfanatic7/running-kali-linux-on-windows-51ad95166e6e
  - https://learn.microsoft.com/en-us/windows/wsl/install
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wsl_kali_linux_usage.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-10
tags:
  - attack.stealth
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection_img_appdata:
    - Image|contains|all:
        - :\Users\
        - \AppData\Local\packages\KaliLinux
    - Image|contains|all:
        - :\Users\
        - \AppData\Local\Microsoft\WindowsApps\kali.exe
  selection_img_windowsapps:
    Image|contains: :\Program Files\WindowsApps\KaliLinux.
    Image|endswith: \kali.exe
  selection_kali_wsl_parent:
    ParentImage|endswith:
      - \wsl.exe
      - \wslhost.exe
  selection_kali_wsl_child:
    - Image|contains:
        - \kali.exe
        - \KaliLinux
    - CommandLine|contains:
        - Kali.exe
        - Kali-linux
        - kalilinux
  filter_main_install_uninstall:
    CommandLine|contains:
      - " -i "
      - " --install "
      - " --unregister "
  condition: 1 of selection_img_* or all of selection_kali_* and not 1 of filter_main_*
falsepositives:
  - Legitimate installation or usage of Kali Linux WSL by administrators or security teams
level: high
license: DRL-1.1
related:
  - id: 6f1a11aa-4b8a-4b7f-9e13-4d3e4ff0e0d4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL