Windows Binary Executed From WSL

Detects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child relationships