Suspicious WSL InstallLocation Registry Key Modification Via CommandLine

calendar Oct 2, 2026 · attack.stealth attack.defense-impairment attack.persistence attack.t1112 attack.t1218  ·
Share on: linkedin copy

Detects the use of reg.exe or PowerShell to modify the WSL InstallLocation registry key via command-line arguments. Legitimate modifications to this key are performed exclusively by the Windows Installer (msiexec.exe) during WSL package installation or update. Manual use of reg.exe or PowerShell to set this value strongly indicates an attempt to redirect WSL execution to a malicious binary.

Sigma rule (View on GitHub)

 1title: Suspicious WSL InstallLocation Registry Key Modification Via CommandLine
 2id: f9f62824-de4e-40ca-afe7-8358f76a876d
 3related:
 4    - id: 83475063-b1c8-4774-9568-69bbda71a539
 5      type: similar
 6status: experimental
 7description: |
 8    Detects the use of reg.exe or PowerShell to modify the WSL InstallLocation registry key via command-line arguments.
 9    Legitimate modifications to this key are performed exclusively by the Windows Installer (msiexec.exe) during WSL package installation or update.
10    Manual use of reg.exe or PowerShell to set this value strongly indicates an attempt to redirect WSL execution to a malicious binary.    
11references:
12    - https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
13    - https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
14    - https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
15    - https://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
16    - https://learn.microsoft.com/en-us/windows/wsl/
17author: Swachchhanda Shrawan Poudel (Nextron Systems)
18date: 2026-05-05
19tags:
20    - attack.stealth
21    - attack.defense-impairment
22    - attack.persistence
23    - attack.t1112
24    - attack.t1218
25logsource:
26    category: process_creation
27    product: windows
28detection:
29    selection_img:
30        - Image|endswith:
31              - '\powershell.exe'
32              - '\pwsh.exe'
33              - '\reg.exe'
34        - OriginalFileName:
35              - 'powershell.exe'
36              - 'pwsh.dll'
37              - 'reg.exe'
38    selection_cli_action:
39        CommandLine|contains:
40            - ' add '           # reg.exe add subcommand
41            - 'New-ItemProperty'
42            - 'Set-ItemProperty'
43            - 'sp '             # PowerShell alias for Set-ItemProperty
44    selection_cli_key:
45        CommandLine|contains:
46            - '\Lxss\MSI'
47            - '/Lxss/MSI'       # forward-slash variant sometimes used with PowerShell paths
48    selection_cli_value:
49        CommandLine|contains: 'InstallLocation'
50    condition: all of selection_*
51falsepositives:
52    - Unlikely
53level: high
54regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wsl_installlocation_modification_via_cmdline/info.yml

References

Related rules

to-top