Suspicious WSL InstallLocation Registry Key Modification Via CommandLine

Title: Suspicious WSL InstallLocation Registry Key Modification Via CommandLine
Status: experimental
Description:Detects the use of reg.exe or PowerShell to modify the WSL InstallLocation registry key via command-line arguments. Legitimate modifications to this key are performed exclusively by the Windows Installer (msiexec.exe) during WSL package installation or update. Manual use of reg.exe or PowerShell to set this value strongly indicates an attempt to redirect WSL execution to a malicious binary.
References:
  -https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
  -https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
  -https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
  -https://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
  -https://learn.microsoft.com/en-us/windows/wsl/
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-05-05
modified:None
Tags:

• -'attack.stealth'
• -'attack.defense-impairment'
• -'attack.persistence'
• -'attack.t1112'
• -'attack.t1218'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\reg.exe'
    - OriginalFileName:
      - 'powershell.exe'
      - 'pwsh.dll'
      - 'reg.exe'
  selection_cli_action:
    CommandLine|contains:
      -' add '
      -'New-ItemProperty'
      -'Set-ItemProperty'
      -'sp '

  selection_cli_key:
    CommandLine|contains:
      -'\Lxss\MSI'
      -'/Lxss/MSI'

  selection_cli_value:
    CommandLine|contains: 'InstallLocation'
  condition:all of selection_*
Falsepositives:
  -Unlikely
Level: high