DllHost.exe Malicious File Drop in High-Risk Directories via WSL2 Proxy

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•2

Detects instances where the legitimate Windows DllHost.exe process creates or modifies executable or script files in common directories frequently used for staging malicious payloads, such as public folders, temporary directories, and program data. This behavior is often associated with process injection or side-loading techniques where a trusted process is abused to drop secondary malicious files.