DllHost Payload Staging via WSL

Ethan Andrews@eandrews

•updated Jun 8, 2026•5•0•18

Detects instances where the Windows COM surrogate (DllHost.exe) writes executable files or scripts to user-writable/temp directories. This proxy file-write behavior indicates potential WSL2 payload staging that bypasses network telemetry.