Suspicious WSL Binary Hijack via Proxy Execution

01

description

What this is, in brief.

Detects C:\Windows\System32\wsl.exe spawning a child wsl.exe process from outside the legitimate WSL install locations. When WSL or bash is invoked, the System32 stub (wsl.exe) looks up the InstallLocation registry key and executes the wsl.exe found there. An attacker who modifies InstallLocation to a controlled path causes the stub to transparently proxy execution to a malicious payload, which then appears as a wsl.exe child of the legitimate System32 stub.

02

rule source (YAML)

title: Suspicious WSL Binary Hijack via Proxy Execution
id: 88d306e9-8e2d-4025-9768-28757d2732db
status: experimental
description: |
    Detects C:\Windows\System32\wsl.exe spawning a child wsl.exe process from outside the legitimate WSL install locations.
    When WSL or bash is invoked, the System32 stub (wsl.exe) looks up the InstallLocation registry key and executes the wsl.exe found there.
    An attacker who modifies InstallLocation to a controlled path causes the stub to transparently proxy execution to a malicious payload,
    which then appears as a wsl.exe child of the legitimate System32 stub.
references:
    - https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
    - https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
    - https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
    - https://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
    - https://learn.microsoft.com/en-us/windows/wsl/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-05-05
tags:
    - attack.stealth
    - attack.t1036.005
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage: 'C:\Windows\System32\wsl.exe'
        Image|endswith: '\wsl.exe'
    filter_main_legit_paths_1:
        Image:
            - 'C:\Windows\System32\wsl.exe'
            - 'C:\Program Files\WSL\wsl.exe'
    filter_main_legit_paths_2:
        Image|startswith:
            - 'C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_'
            - 'C:\Windows\WinSxS\arm64_microsoft-windows-lxss-wsl_'
            - 'C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux'
    filter_main_legit_paths_3:
        Image|startswith: 'C:\Users\'
        Image|contains: '\AppData\Local\Microsoft\WindowsApps\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wsl_binary_hijack_execution/info.yml

04

detects techniques (2)

ATT&CK techniques this enables or maps to.

05

references

External citations — patches, advisories, analysis.