Potential WSL Binary Modification from Installed Location
Detects the modification of the wsl.exe binary from its installed location. Attackers can replace the legitimate wsl.exe binary with a malicious payload in its place, which is then executed when the user runs WSL,…
Description
Detects the modification of the wsl.exe binary from its installed location. Attackers can replace the legitimate wsl.exe binary with a malicious payload in its place, which is then executed when the user runs WSL, acting as a proxy execution and defense evasion technique.
Detection logic
Detection requirements
- Platform
- ContainersESXiLinuxmacOSWindows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
- Log source product
- windows
- Log source category
- file_event
Known benign triggers
- Unlikely
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
References
| Reference | Cited by |
|---|---|
| blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2 | 5 |
| cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/ | 5 |
| learn.microsoft.com/en-us/windows/wsl/ | 5 |
| thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html | 5 |
| www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/ | 5 |
From the source
- At source
- Open at source
- Upstream identifier
- 2f400434-01e1-416b-b52c-bb5bfbb9eb78
- Tagged by the source as
- attack.stealth
Licence
- Published under
- Detection Rule License 1.1Read the licence
- Attribution
- Required
Authorship
- Published
- Oct 3, 2026
- Version
- 1