WSL2 Interop Spawning cmd.exe or powershell.exe via wsl.exe Parent
Detects the invocation of Windows command-line utilities (such as cmd.exe or powershell.exe) by the Windows Subsystem for Linux (WSL) process wsl.exe. This behavior indicates that a Linux-side process or user is leveraging the WSL interoperability layer to execute commands directly within the Windows host environment, which can be a technique used for defense evasion or moving between Linux and Windows contexts.
YARA-L
