Potential WSL InstallLocation Registry Key Modification

Title: Potential WSL InstallLocation Registry Key Modification
Status: experimental
Description:Detects modifications to the Windows Subsystem for Linux (WSL) InstallLocation registry key. Attackers can modify this registry key to redirect the execution flow of legitimate WSL processes (wsl.exe or bash.exe) to a malicious payload, acting as a proxy execution and defense evasion technique.
References:
  -https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
  -https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
  -https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
  -https://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
  -https://learn.microsoft.com/en-us/windows/wsl/
Author: Liran Ravich, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-05-05
modified:None
Tags:

• -'attack.stealth'
• -'attack.defense-impairment'
• -'attack.persistence'
• -'attack.t1112'
• -'attack.t1218'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains: '\Lxss\MSI\InstallLocation'
  filter_main_legitimate_binary:
    - Details:
      - 'C:\Program Files\WSL'
      - '%ProgramFiles%\WSL'
    - Details|contains:
      - ':\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_'
      - '\AppData\Local\Microsoft\WindowsApps'
      - '%ProgramFiles%\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_'
  filter_main_msiexec:
    Image:
      -'C:\Windows\System32\msiexec.exe'
      -'C:\Windows\SysWOW64\msiexec.exe'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unlikely
Level: medium