Suspicious WSL Binary Masquerading

experimentalhigh

log source: windows · process_creationauthor Swachchhanda Shrawan Poudel (Nextron Systems)date 2026-05-05

description

What this is, in brief.

Detects execution of masqueraded wsl.exe binary. Attackers can rename a malicious payload to wsl.exe to masquerade as the legitimate Windows Subsystem for Linux binary, bypassing detection based on image name alone and abusing user trust in the WSL process name.

rule source (YAML)

title: Suspicious WSL Binary Masquerading
id: 530576ee-3b62-4bce-9a03-9aac6c61788a
status: experimental
description: |
    Detects execution of masqueraded wsl.exe binary.
    Attackers can rename a malicious payload to wsl.exe to masquerade as the legitimate Windows Subsystem for Linux binary,
    bypassing detection based on image name alone and abusing user trust in the WSL process name.
references:
    - https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
    - https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
    - https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
    - https://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
    - https://learn.microsoft.com/en-us/windows/wsl/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-05-05
tags:
    - attack.stealth
    - attack.t1036.005
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\wsl.exe'
    filter_main_legit_original:
        OriginalFileName: 'wsl.exe'
    filter_main_null:
        OriginalFileName: null
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wsl_masquerading/info.yml

detects techniques (2)

ATT&CK techniques this enables or maps to.

references

External citations — patches, advisories, analysis.