First-Time WSL.exe Execution on Enterprise Endpoints - Baseline Deviation (T1564.006)
Detects the first-time execution of the Windows Subsystem for Linux (WSL) executable (wsl.exe) on endpoints that have not shown any WSL activity in the previous 29 days. This rule is scoped to workstations and laptops and specifically filters out endpoints tagged with developer-related identifiers to reduce noise on machines where WSL is a legitimate tool.
Microsoft Sentinel (KQL)
