WSL2 DllHost.exe Payload Drop into High-Risk Windows Directories
Detects instances where the DllHost process (COM Surrogate) writes executable files, scripts, or library files to common temporary or user-writable directories. This behavior is often associated with fileless or masqueraded execution techniques where attackers use legitimate system binaries to drop malicious payloads.
CQL
