Windows subsystem for Linux executable
wsl.exe -e /mnt/c/Windows/System32/calc.exe
Executes calc.exe from wsl.exe
Performs execution of specified file, can be used to execute arbitrary Linux commands.
C:\Windows\System32\wsl.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wsl_lolbin_execution.yml, BlockRule: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules, IOC: Child process from wsl.exe
Alex Ionescu (@aionescu), Matt (@NotoriousRebel1), Asif Matadar (@d1r4c), Nasreddine Bencherchali (@nas_bench)