WSL2 DllHost.exe File Drop in High-Risk Windows Directories via /mnt/c/
Detects instances where DllHost.exe creates potentially malicious executable or script files in sensitive Windows system directories (e.g., \Users\Public\, \ProgramData\). This is often an indicator of WSL2 filesystem proxying, where a Linux process running within a WSL2 distribution performs file operations on the Windows filesystem that are attributed to the DllHost.exe process on the Windows host, potentially allowing for evasion of local security controls.
YARA-L
