WSL Payload Staged by DllHost.exe Executed via Scheduled Task or Service

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects a suspicious sequence where DllHost.exe writes an executable or script to a common public directory (such as C:\Users\Public\, C:\Windows\Temp\, or C:\ProgramData\), followed by the execution of that file within 30 minutes by a system process (svchost.exe or services.exe), often indicative of a scheduled task or service-based persistence mechanism.