Detection rules › Sigma
Arbitrary Command Execution Using WSL
Detects potential abuse of Windows Subsystem for Linux (WSL) binary as a Living of the Land binary in order to execute arbitrary Linux or Windows commands.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1202 Indirect Command Execution, T1218 System Binary Proxy Execution |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
title: Arbitrary Command Execution Using WSL
id: dec44ca7-61ad-493c-bfd7-8819c5faa09b
related:
- id: 2267fe65-0681-42ad-9a6d-46553d3f3480 # Generic susp child processes rules
type: similar
status: test
description: |
Detects potential abuse of Windows Subsystem for Linux (WSL) binary as a Living of the Land binary in order to execute arbitrary Linux or Windows commands.
references:
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/
- https://twitter.com/nas_bench/status/1535431474429808642
author: oscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems)
date: 2020-10-05
modified: 2023-04-12
tags:
- attack.execution
- attack.stealth
- attack.t1218
- attack.t1202
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: '\wsl.exe'
- OriginalFileName: 'wsl.exe'
selection_cli:
CommandLine|contains:
- ' -e '
- ' --exec'
- ' --system'
- ' --shell-type '
- ' /mnt/c' # Path to mounted "C:\" partition (Indication of running Windows binaries via WSL)
- ' --user root'
- ' -u root'
- '--debug-shell'
filter_main_kill:
# This filter is to handle a FP that occurs when a process is spawned from WSL and then closed by the user
# Example would be to open VsCode through it's server extension from WSL
# GrandparentCommandLine: "C:\Users\XXX\AppData\Local\Programs\Microsoft VS Code\Code.exe" --ms-enable-electron-run-as-node c:\Users\XXX\.vscode\extensions\ms-vscode-remote.remote-wsl-0.72.0\dist\wslDaemon.js
# ParentCommandLine: C:\WINDOWS\system32\cmd.exe /d /s /c "C:\WINDOWS\System32\wsl.exe -d Ubuntu-20.04 -e kill 1366"
# CommandLine: C:\WINDOWS\System32\wsl.exe -d Ubuntu-20.04 -e kill 1366
ParentImage|endswith: '\cmd.exe'
CommandLine|contains|all:
- ' -d '
- ' -e kill '
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Automation and orchestration scripts may use this method to execute scripts etc.
- Legitimate use by Windows to kill processes opened via WSL (example VsCode WSL server)
level: medium
Stages and Predicates
Stage 0: condition
all of selection_* and not 1 of filter_main_*Stage 1: selection_img
selection_img:
- Image|endswith: '\wsl.exe'
- OriginalFileName: 'wsl.exe'
Stage 2: selection_cli
selection_cli:
CommandLine|contains:
- ' -e '
- ' --exec'
- ' --system'
- ' --shell-type '
- ' /mnt/c'
- ' --user root'
- ' -u root'
- '--debug-shell'
Stage 3: not filter_main_kill
filter_main_kill:
ParentImage|endswith: '\cmd.exe'
CommandLine|contains|all:
- ' -d '
- ' -e kill '
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
CommandLine | match | -d |
CommandLine | match | -e kill |
ParentImage | ends_with | \cmd.exe |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|
Image | ends_with |
|
OriginalFileName | eq |
|