Installation of WSL Kali-Linux

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL). Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.

Known false positives

Legitimate installation or usage of Kali Linux WSL by administrators or security teams

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Installation of WSL Kali-Linux
id: eca8ae39-5c3c-4321-b538-9e64fe25822e
status: experimental
description: |
    Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL).
    Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.
references:
    - https://medium.com/@redfanatic7/running-kali-linux-on-windows-51ad95166e6e
    - https://learn.microsoft.com/en-us/windows/wsl/install
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-10-10
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_wsl_img:
        - Image|endswith: '\wsl.exe'
        - OriginalFileName: 'wsl'
    selection_wsl_install:
        CommandLine|contains:
            - ' --install '
            - ' -i '
    selection_wsl_kali:
        CommandLine|contains: 'kali'
    condition: all of selection_wsl_*
falsepositives:
    - Legitimate installation or usage of Kali Linux WSL by administrators or security teams
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_wsl_*

Stage 1: `selection_wsl_img`

selection_wsl_img:
    - Image|endswith: '\wsl.exe'
    - OriginalFileName: 'wsl'

Stage 2: `selection_wsl_install`

selection_wsl_install:
    CommandLine|contains:
        - ' --install '
        - ' -i '

Stage 3: `selection_wsl_kali`

selection_wsl_kali:
    CommandLine|contains: 'kali'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`--install` `-i` corpus 4 (sigma 4) `kali`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\wsl.exe` corpus 11 (sigma 11)	`field:"Image" kind:ends_with value:"\wsl.exe"`
`OriginalFileName`	eq	`wsl`	`field:"OriginalFileName" kind:eq value:"wsl"`