Suspicious WSL Binary Masquerading

Title: Suspicious WSL Binary Masquerading
Status: experimental
Description:Detects execution of masqueraded wsl.exe binary. Attackers can rename a malicious payload to wsl.exe to masquerade as the legitimate Windows Subsystem for Linux binary, bypassing detection based on image name alone and abusing user trust in the WSL process name.
References:
  -https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
  -https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
  -https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
  -https://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
  -https://learn.microsoft.com/en-us/windows/wsl/
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-05-05
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1036.005'
• -'attack.t1218'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\wsl.exe'
  filter_main_legit_original:
    OriginalFileName: 'wsl.exe'
  filter_main_null:
    OriginalFileName: 'None'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unlikely
Level: high