WSL2 Unexpected Launch Enabling Linux Process Execution Evasion

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects the execution of Windows Subsystem for Linux (WSL) components, including wsl.exe, wslhost.exe, and wslservice.exe. WSL can be leveraged by adversaries to execute malicious code within a Linux environment on a Windows host, potentially bypassing Windows-specific security controls.