DllHost.exe Creating Executable/Script Files in High-Risk Directories (WSL2 Proxy)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects instances where the Dllhost.exe (COM Surrogate) process writes executable files, scripts, or library files to common temporary or public directories. This behavior is often associated with COM hijacking, lateral movement, or malicious payload staging by adversaries.