WSL2 Payload Staging — Windows Process Spawned by wsl.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects instances where the Windows Subsystem for Linux (wsl.exe) process is used to launch standard Windows command-line interpreters (cmd.exe, powershell.exe, or pwsh.exe). This pattern is often used as a technique to facilitate cross-environment execution or to evade certain security controls by running Windows binaries from within the WSL context.