WSL2 Interop Spawning Windows Executables - Network Evasion Detection

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects when the Windows Subsystem for Linux (WSL) process (wsl.exe) launches common Windows binaries or scripting engines. This behavior is indicative of potential cross-environment execution, where attackers use the Linux subsystem to bypass Windows-based security controls or to execute malicious payloads, living-off-the-land techniques, or command-and-control activities within the Windows environment.