WSL2 Interop LOLBin Execution Spawned from wsl.exe Parent

Ibrahim Saud@tektrix

•updated Jun 30, 2026•21•0•4

Detects the execution of known Living-off-the-Land (LotL) binaries (e.g., powershell.exe, certutil.exe, mshta.exe) where the parent or initiating process is the Windows Subsystem for Linux (WSL2) wsl.exe binary. This pattern indicates potential abuse of WSL2 interop features to execute Windows-native binaries from a Linux environment, often used to bypass traditional host-based monitoring or security controls.