WSL2 Interop Boundary Crossing: wsl.exe Spawning Windows Child Processes
Detects the initialization and execution of processes within the Windows Subsystem for Linux (WSL) environment, specifically tracking the start of WSL processes or the invocation of WSL-related binaries like wsl.exe and vmmem. This allows security teams to monitor interop operations between the host Windows OS and the Linux subsystem.
Cortex XDR
