WSL Kali Linux Usage Detection

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•0•35

This rule detects the execution of Kali Linux through Windows Subsystem for Linux (WSL). It identifies processes whose image paths contain typical Kali Linux installation directories within AppData or Program Files, or processes named 'kali.exe' or containing 'KaliLinux' in their image or command line, especially when their parent process is 'wsl.exe' or 'wslhost.exe'. The rule filters out common installation or uninstallation commands to reduce false positives.