Suspicious WSL Binary Hijack via Proxy Execution

Title: Suspicious WSL Binary Hijack via Proxy Execution
Status: experimental
Description:Detects C:\Windows\System32\wsl.exe spawning a child wsl.exe process from outside the legitimate WSL install locations. When WSL or bash is invoked, the System32 stub (wsl.exe) looks up the InstallLocation registry key and executes the wsl.exe found there. An attacker who modifies InstallLocation to a controlled path causes the stub to transparently proxy execution to a malicious payload, which then appears as a wsl.exe child of the legitimate System32 stub.
References:
  -https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
  -https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
  -https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
  -https://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
  -https://learn.microsoft.com/en-us/windows/wsl/
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-05-05
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1036.005'
• -'attack.t1218'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentImage: 'C:\Windows\System32\wsl.exe'
    Image|endswith: '\wsl.exe'
  filter_main_legit_paths_1:
    Image:
      -'C:\Windows\System32\wsl.exe'
      -'C:\Program Files\WSL\wsl.exe'

  filter_main_legit_paths_2:
    Image|startswith:
      -'C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_'
      -'C:\Windows\WinSxS\arm64_microsoft-windows-lxss-wsl_'
      -'C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux'

  filter_main_legit_paths_3:
    Image|startswith: 'C:\Users\'
    Image|contains: '\AppData\Local\Microsoft\WindowsApps\'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unlikely
Level: high