Potential WSL Binary Modification from Installed Location

calendar Oct 2, 2026 · attack.stealth attack.t1036.005 attack.t1218  ·
Share on: linkedin copy

Detects the modification of the wsl.exe binary from its installed location. Attackers can replace the legitimate wsl.exe binary with a malicious payload in its place, which is then executed when the user runs WSL, acting as a proxy execution and defense evasion technique.

Sigma rule (View on GitHub)

 1title: Potential WSL Binary Modification from Installed Location
 2id: 2f400434-01e1-416b-b52c-bb5bfbb9eb78
 3status: experimental
 4description: |
 5    Detects the modification of the wsl.exe binary from its installed location.
 6    Attackers can replace the legitimate wsl.exe binary with a malicious payload in its place, which is then executed when the user runs WSL, acting as a proxy execution and defense evasion technique.    
 7references:
 8    - https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
 9    - https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
10    - https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
11    - https://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
12    - https://learn.microsoft.com/en-us/windows/wsl/
13author: Liran Ravich, Swachchhanda Shrawan Poudel (Nextron Systems)
14date: 2026-05-05
15tags:
16    - attack.stealth
17    - attack.t1036.005
18    - attack.t1218
19logsource:
20    category: file_event
21    product: windows
22detection:
23    selection_wsl_exe:
24        TargetFilename|endswith: '\wsl.exe'
25    selection_wsl_folder:
26        - TargetFilename|contains:
27              - ':\Program files\wsl\'
28              - ':\Program files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_'
29        - TargetFilename|contains|all:
30              - ':\Users\'
31              - '\AppData\Local\Microsoft\WindowsApps\'
32    filter_main_msiexec:
33        Image:
34            - 'C:\Windows\System32\msiexec.exe'
35            - 'C:\Windows\SysWOW64\msiexec.exe'
36    filter_main_svchost:
37        Image: 'C:\Windows\System32\svchost.exe'
38        TargetFilename|contains: '\WindowsApps\'
39    condition: all of selection_* and not 1 of filter_main_*
40falsepositives:
41    - Unlikely
42level: medium
43regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_wsl_binary_modification/info.yml

References

Related rules

to-top