Suspicious WSL Binary Masquerading

calendar Oct 2, 2026 · attack.stealth attack.t1036.005 attack.t1218  ·
Share on: linkedin copy

Detects execution of masqueraded wsl.exe binary. Attackers can rename a malicious payload to wsl.exe to masquerade as the legitimate Windows Subsystem for Linux binary, bypassing detection based on image name alone and abusing user trust in the WSL process name.

Sigma rule (View on GitHub)

 1title: Suspicious WSL Binary Masquerading
 2id: 530576ee-3b62-4bce-9a03-9aac6c61788a
 3status: experimental
 4description: |
 5    Detects execution of masqueraded wsl.exe binary.
 6    Attackers can rename a malicious payload to wsl.exe to masquerade as the legitimate Windows Subsystem for Linux binary,
 7    bypassing detection based on image name alone and abusing user trust in the WSL process name.    
 8references:
 9    - https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
10    - https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
11    - https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
12    - https://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
13    - https://learn.microsoft.com/en-us/windows/wsl/
14author: Swachchhanda Shrawan Poudel (Nextron Systems)
15date: 2026-05-05
16tags:
17    - attack.stealth
18    - attack.t1036.005
19    - attack.t1218
20logsource:
21    category: process_creation
22    product: windows
23detection:
24    selection:
25        Image|endswith: '\wsl.exe'
26    filter_main_legit_original:
27        OriginalFileName: 'wsl.exe'
28    filter_main_null:
29        OriginalFileName: null
30    condition: selection and not 1 of filter_main_*
31falsepositives:
32    - Unlikely
33level: high
34regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wsl_masquerading/info.yml

References

Related rules

to-top