WSL2 Network Evasion — wsl.exe Execution and Interop Child Process Spawning

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects activities related to the Windows Subsystem for Linux (WSL2), including the execution of wsl.exe, wslhost.exe, or wslservice.exe, as well as the active presence of the vmmemWSL virtual machine process. Monitoring WSL2 activity is important as adversaries can use the Linux environment to bypass traditional Windows security controls, execute Linux-native tools, or maintain persistence.