WSL Interop Process Execution
Detects the execution of Windows processes where the parent process is wsl.exe. This indicates WSL interop functionality being used to execute host-side binaries from within the Linux environment, a technique often used to trigger staged payloads.
Microsoft Sentinel (KQL)
