WSL2 DllHost.exe Payload Staging in High-Risk Directories

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects instances where the DllHost.exe process creates files with executable-like extensions (exe, dll, ps1, bat, cmd, vbs, hta, scr) within high-risk, world-writable directories such as C:\Users\Public, C:\Windows\Temp, C:\ProgramData, C:\Users\Default, or AppData\Local\Temp. This behavior is often indicative of malicious activity, such as file drops for further execution or persistence, as legitimate COM surrogate activity rarely results in file creation in these specific locations.