WSL2 DllHost.exe Payload Drop in High-Risk Windows Directories

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects instances where DllHost.exe creates executable or script files within sensitive Windows directories (e.g., Public, Temp, ProgramData). This behavior is often indicative of WSL2 filesystem proxying, where a Linux process initiates a file write to the Windows filesystem via /mnt/c/, causing the DllHost.exe process to proxy the write operation and obscuring the original Linux process origin.