Windows Binary Executed From WSL

SigmaHQ Detections@sigmaHQ

•updated Aug 29, 2024•1•0•34

Detects the execution of Windows binaries from within a Windows Subsystem for Linux (WSL) instance. This technique can be used by adversaries to masquerade parent-child process relationships, making it harder to detect malicious activity.