Windows Subsystem for Linux (WSL) package turned on (native)

Detects scenarios where an attacker enables the WSL to cary out malicious activities in a virtual instance to avoid detection.