WSL2 Payload Staging via DllHost.exe File Creation in Writable Paths

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•3

Detects the creation of suspicious file types (.exe, .dll, .ps1, etc.) in common staging directories (e.g., C:\Users\Public, C:\Windows\Temp) by the DllHost.exe process. The rule filters out known-good COM surrogate CLSIDs but flags instances where DllHost.exe is launched without a /Processid argument (potential WSL2 proxy activity) or with an unrecognized CLSID, suggesting potential COM hijacking or file staging.