WSL2 Payload Staging via DllHost.exe File Drop with No Network Visibility
Detects suspicious file drops by DllHost.exe into staging directories (e.g., C:\Users\Public\ or C:\ProgramData\) occurring shortly after the execution of wsl.exe, where the DllHost process itself exhibits no network activity in the host telemetry. This behavior is indicative of an attacker leveraging the Windows Subsystem for Linux (WSL2) to download payloads or tools that bypass standard Windows network monitoring, leaving behind an artifact dropped by a COM surrogate.
Microsoft Sentinel (KQL)
