Windows Subsystem for Linux (WSL) installation (PowerShell)

Status: experimental
Severity: medium
Log source: category ['ps_module', 'ps_classic_script', 'ps_script'], product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker enables the WSL to cary out malicious activities in a virtual instance to avoid detection.

Known false positives

developer computer (with Visual Studio Code)
administrator activity

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1564.006` Hide Artifacts: Run Virtual Instance

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4103: Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

title: Windows Subsystem for Linux (WSL) installation (PowerShell)
description: Detects scenarios where an attacker enables the WSL to cary out malicious activities in a virtual instance to avoid detection.
references:
- https://www.hackers-arise.com/post/linux-basics-for-hackers-part-13-the-windows-subsystem-for-linux-wsl
- https://linuxhint.com/enable-wsl-optional-component/
- https://blog.lumen.com/no-longer-just-theory-black-lotus-labs-uncovers-linux-executables-deployed-as-stealth-windows-loaders/
- https://learn.microsoft.com/en-us/windows/wsl/
tags:
- attack.defense_evasion
- attack.t1564.006
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection: # full command "Enable-windowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux"
  selection2_powershell_modern:
    EventID: 4103
    Payload|contains:
      - 'Enable-windowsOptionalFeature'
      - 'Microsoft-Windows-Subsystem-Linux'

  selection3_powershell_block:
    EventID: 4104
    ScriptBlockText|contains:
      - 'Enable-windowsOptionalFeature'
      - 'Microsoft-Windows-Subsystem-Linux'

  condition: 1 of selection*
falsepositives:
- developer computer (with Visual Studio Code)
- administrator activity
level: medium

Stages and Predicates

Stage 0: `condition`

1 of selection*

Stage 1: `selection2_powershell_modern`

selection2_powershell_modern:
  EventID: 4103
  Payload|contains:
    - 'Enable-windowsOptionalFeature'
    - 'Microsoft-Windows-Subsystem-Linux'

Stage 2: `selection3_powershell_block`

selection3_powershell_block:
  EventID: 4104
  ScriptBlockText|contains:
    - 'Enable-windowsOptionalFeature'
    - 'Microsoft-Windows-Subsystem-Linux'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Payload`	match	`Enable-windowsOptionalFeature` `Microsoft-Windows-Subsystem-Linux`	`field:"Payload" kind:match`
`ScriptBlockText`	match	`Enable-windowsOptionalFeature` corpus 3 (sigma 2, splunk 1) `Microsoft-Windows-Subsystem-Linux` corpus 2 (sigma 2)	`field:"ScriptBlockText" kind:match`

Windows Subsystem for Linux (WSL) installation (PowerShell)

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection2_powershell_modern

Stage 2: selection3_powershell_block

Indicators

Stage 0: `condition`

Stage 1: `selection2_powershell_modern`

Stage 2: `selection3_powershell_block`