Suspicious WSL Binary Hijack via Proxy Execution

calendar Oct 2, 2026 · attack.stealth attack.t1036.005 attack.t1218  ·
Share on: linkedin copy

Detects C:\Windows\System32\wsl.exe spawning a child wsl.exe process from outside the legitimate WSL install locations. When WSL or bash is invoked, the System32 stub (wsl.exe) looks up the InstallLocation registry key and executes the wsl.exe found there. An attacker who modifies InstallLocation to a controlled path causes the stub to transparently proxy execution to a malicious payload, which then appears as a wsl.exe child of the legitimate System32 stub.

Sigma rule (View on GitHub)

 1title: Suspicious WSL Binary Hijack via Proxy Execution
 2id: 88d306e9-8e2d-4025-9768-28757d2732db
 3status: experimental
 4description: |
 5    Detects C:\Windows\System32\wsl.exe spawning a child wsl.exe process from outside the legitimate WSL install locations.
 6    When WSL or bash is invoked, the System32 stub (wsl.exe) looks up the InstallLocation registry key and executes the wsl.exe found there.
 7    An attacker who modifies InstallLocation to a controlled path causes the stub to transparently proxy execution to a malicious payload,
 8    which then appears as a wsl.exe child of the legitimate System32 stub.    
 9references:
10    - https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
11    - https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
12    - https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
13    - https://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
14    - https://learn.microsoft.com/en-us/windows/wsl/
15author: Swachchhanda Shrawan Poudel (Nextron Systems)
16date: 2026-05-05
17tags:
18    - attack.stealth
19    - attack.t1036.005
20    - attack.t1218
21logsource:
22    category: process_creation
23    product: windows
24detection:
25    selection:
26        ParentImage: 'C:\Windows\System32\wsl.exe'
27        Image|endswith: '\wsl.exe'
28    filter_main_legit_paths_1:
29        Image:
30            - 'C:\Windows\System32\wsl.exe'
31            - 'C:\Program Files\WSL\wsl.exe'
32    filter_main_legit_paths_2:
33        Image|startswith:
34            - 'C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_'
35            - 'C:\Windows\WinSxS\arm64_microsoft-windows-lxss-wsl_'
36            - 'C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux'
37    filter_main_legit_paths_3:
38        Image|startswith: 'C:\Users\'
39        Image|contains: '\AppData\Local\Microsoft\WindowsApps\'
40    condition: selection and not 1 of filter_main_*
41falsepositives:
42    - Unlikely
43level: high
44regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wsl_binary_hijack_execution/info.yml

References

Related rules

to-top