WSL2 Payload Staging via DllHost.exe File Write to High-Risk Windows Directories

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects instances where the DllHost.exe process creates or writes files with common executable or script extensions (.exe, .dll, .ps1, .bat, .cmd, .vbs, .hta, .scr, .sh) into suspicious, publicly writable, or temporary directories. This behavior is indicative of potential malicious payload staging, masquerading, or post-exploitation activity.