Installation of WSL Kali-Linux

calendar Oct 23, 2025 · attack.execution attack.t1059  ·
Share on: linkedin copy

Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL). Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.

Sigma rule (View on GitHub)

 1title: Installation of WSL Kali-Linux
 2id: eca8ae39-5c3c-4321-b538-9e64fe25822e
 3status: experimental
 4description: |
 5    Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL).
 6    Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.    
 7references:
 8    - https://medium.com/@redfanatic7/running-kali-linux-on-windows-51ad95166e6e
 9    - https://learn.microsoft.com/en-us/windows/wsl/install
10author: Swachchhanda Shrawan Poudel (Nextron Systems)
11date: 2025-10-10
12tags:
13    - attack.execution
14    - attack.t1059
15logsource:
16    category: process_creation
17    product: windows
18detection:
19    selection_wsl_img:
20        - Image|endswith: '\wsl.exe'
21        - OriginalFileName: 'wsl'
22    selection_wsl_install:
23        CommandLine|contains:
24            - ' --install '
25            - ' -i '
26    selection_wsl_kali:
27        CommandLine|contains: 'kali'
28    condition: all of selection_wsl_*
29falsepositives:
30    - Legitimate installation or usage of Kali Linux WSL by administrators or security teams
31level: high

References

  • Running Kali Linux on Windows

    I recently configured my device to run Windows and Kali Linux nonstop using WSL2, which has improved my workflow. I’ve tried various…


    Read More

  • Install WSL

    Install Windows Subsystem for Linux with the command, wsl --install. Use a Bash terminal on your Windows machine run by your preferred Linux distribution - Ubuntu, Debian, SUSE, Kali, Fedora, Pengwin, Alpine, and more are available.


    Read More

Related rules

to-top