Suspicious WSL Binary Hijack via Proxy Execution

experimentalhigh
Log-Quelle: windows · process_creationAutor Swachchhanda Shrawan Poudel (Nextron Systems)Datum 2026-05-05
01

Beschreibung

Was dies ist, in Kürze.

Detects C:\Windows\System32\wsl.exe spawning a child wsl.exe process from outside the legitimate WSL install locations. When WSL or bash is invoked, the System32 stub (wsl.exe) looks up the InstallLocation registry key and executes the wsl.exe found there. An attacker who modifies InstallLocation to a controlled path causes the stub to transparently proxy execution to a malicious payload, which then appears as a wsl.exe child of the legitimate System32 stub.

02

Tags

attack.stealthattack.t1036.005attack.t1218
03

Regelquelle (YAML)

title: Suspicious WSL Binary Hijack via Proxy Execution
id: 88d306e9-8e2d-4025-9768-28757d2732db
status: experimental
description: |
    Detects C:\Windows\System32\wsl.exe spawning a child wsl.exe process from outside the legitimate WSL install locations.
    When WSL or bash is invoked, the System32 stub (wsl.exe) looks up the InstallLocation registry key and executes the wsl.exe found there.
    An attacker who modifies InstallLocation to a controlled path causes the stub to transparently proxy execution to a malicious payload,
    which then appears as a wsl.exe child of the legitimate System32 stub.
references:
    - https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
    - https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
    - https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
    - https://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
    - https://learn.microsoft.com/en-us/windows/wsl/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-05-05
tags:
    - attack.stealth
    - attack.t1036.005
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage: 'C:\Windows\System32\wsl.exe'
        Image|endswith: '\wsl.exe'
    filter_main_legit_paths_1:
        Image:
            - 'C:\Windows\System32\wsl.exe'
            - 'C:\Program Files\WSL\wsl.exe'
    filter_main_legit_paths_2:
        Image|startswith:
            - 'C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_'
            - 'C:\Windows\WinSxS\arm64_microsoft-windows-lxss-wsl_'
            - 'C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux'
    filter_main_legit_paths_3:
        Image|startswith: 'C:\Users\'
        Image|contains: '\AppData\Local\Microsoft\WindowsApps\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wsl_binary_hijack_execution/info.yml
04

erkennt Techniken (2)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.