WSL2 curl/wget payload staging via wsl.exe spawning download tools
Detects instances where the Windows Subsystem for Linux (WSL2) wsl.exe process is used to execute curl or wget from the Windows host. This technique is often used to stage payloads or download tools from the internet, effectively bypassing Windows-based EDR network monitoring as the network connection occurs within the isolated WSL2 environment.
YARA-L
