Potential WSL InstallLocation Registry Key Modification

calendar Oct 2, 2026 · attack.stealth attack.defense-impairment attack.persistence attack.t1112 attack.t1218  ·
Share on: linkedin copy

Detects modifications to the Windows Subsystem for Linux (WSL) InstallLocation registry key. Attackers can modify this registry key to redirect the execution flow of legitimate WSL processes (wsl.exe or bash.exe) to a malicious payload, acting as a proxy execution and defense evasion technique.

Sigma rule (View on GitHub)

 1title: Potential WSL InstallLocation Registry Key Modification
 2id: 83475063-b1c8-4774-9568-69bbda71a539
 3related:
 4    - id: f9f62824-de4e-40ca-afe7-8358f76a876d
 5      type: similar
 6status: experimental
 7description: |
 8    Detects modifications to the Windows Subsystem for Linux (WSL) InstallLocation registry key.
 9    Attackers can modify this registry key to redirect the execution flow of legitimate WSL processes (wsl.exe or bash.exe) to a malicious payload, acting as a proxy execution and defense evasion technique.    
10references:
11    - https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
12    - https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
13    - https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
14    - https://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
15    - https://learn.microsoft.com/en-us/windows/wsl/
16author: Liran Ravich, Swachchhanda Shrawan Poudel (Nextron Systems)
17date: 2026-05-05
18tags:
19    - attack.stealth
20    - attack.defense-impairment
21    - attack.persistence
22    - attack.t1112
23    - attack.t1218
24logsource:
25    category: registry_set
26    product: windows
27detection:
28    selection:
29        TargetObject|contains: '\Lxss\MSI\InstallLocation'
30    filter_main_legitimate_binary:
31        - Details:
32              - 'C:\Program Files\WSL'
33              - '%ProgramFiles%\WSL'
34        - Details|contains:
35              - ':\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_'
36              - '\AppData\Local\Microsoft\WindowsApps'
37              - '%ProgramFiles%\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_'
38    filter_main_msiexec:
39        Image:
40            - 'C:\Windows\System32\msiexec.exe'
41            - 'C:\Windows\SysWOW64\msiexec.exe'
42    condition: selection and not 1 of filter_main_*
43falsepositives:
44    - Unlikely
45level: medium
46regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_wsl_installlocation_registry_key_modification/info.yml

References

Related rules

to-top