Suspicious WSL Binary Masquerading

experimentalhigh
Log-Quelle: windows · process_creationAutor Swachchhanda Shrawan Poudel (Nextron Systems)Datum 2026-05-05
01

Beschreibung

Was dies ist, in Kürze.

Detects execution of masqueraded wsl.exe binary. Attackers can rename a malicious payload to wsl.exe to masquerade as the legitimate Windows Subsystem for Linux binary, bypassing detection based on image name alone and abusing user trust in the WSL process name.

02

Tags

attack.stealthattack.t1036.005attack.t1218
03

Regelquelle (YAML)

title: Suspicious WSL Binary Masquerading
id: 530576ee-3b62-4bce-9a03-9aac6c61788a
status: experimental
description: |
    Detects execution of masqueraded wsl.exe binary.
    Attackers can rename a malicious payload to wsl.exe to masquerade as the legitimate Windows Subsystem for Linux binary,
    bypassing detection based on image name alone and abusing user trust in the WSL process name.
references:
    - https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
    - https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
    - https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
    - https://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
    - https://learn.microsoft.com/en-us/windows/wsl/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-05-05
tags:
    - attack.stealth
    - attack.t1036.005
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\wsl.exe'
    filter_main_legit_original:
        OriginalFileName: 'wsl.exe'
    filter_main_null:
        OriginalFileName: null
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wsl_masquerading/info.yml
04

erkennt Techniken (2)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.