WSL2 Payload Staging: DllHost.exe File Drop Within 120s of wsl.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•3

This rule detects the creation of executable or PowerShell script files in common temporary or user-writeable directories by DllHost.exe within 120 seconds of the execution of wsl.exe. This behavior is indicative of potential payload staging where Windows Subsystem for Linux (WSL) might be leveraged to obscure or facilitate the delivery and execution of malicious artifacts.