WSL Child Process Anomaly
Detects uncommon or suspicious child processes spawning from a Windows Subsystem for Linux (WSL) process. This behavior can indicate an attempt to evade parent/child relationship detections, or persistence attempts using cron within WSL. The rule specifically looks for common Windows LOLBINs (Living Off the Land Binaries) or processes launched from suspicious temporary or user-controlled directories, originating from wsl.exe or wslhost.exe.
Sigma
