WSL2 Payload Drop via DllHost.exe File Creation in High-Risk Directories
Detects instances where the Windows process DllHost.exe creates executable or script files in suspicious user-writable directories (e.g., Temp, Public, ProgramData). This behavior is often indicative of WSL2 (Windows Subsystem for Linux) interacting with the Windows host filesystem, where a Linux-based process may attempt to stage payloads on the Windows partition via the WSL2 interop mechanism.
YARA-L
