Detection rules › Sigma
Windows Subsystem for Linux (WSL) installation (command)
Detects scenarios where an attacker enables the WSL to cary out malicious activities in a virtual instance to avoid detection.
Known false positives
- developer computer (with Visual Studio Code)
- administrator activity
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule body
title: Windows Subsystem for Linux (WSL) installation (command)
description: Detects scenarios where an attacker enables the WSL to cary out malicious activities in a virtual instance to avoid detection.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1564-Hide%20artifacts
- https://learn.microsoft.com/en-us/windows/wsl/install-manual
- https://learn.microsoft.com/en-us/windows/wsl/install
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/
- https://blog.f-secure.com/hunting-for-windows-subsystem-for-linux/
- https://blog.lumen.com/no-longer-just-theory-black-lotus-labs-uncovers-linux-executables-deployed-as-stealth-windows-loaders/
tags:
- attack.defense_evasion
- attack.t1564.006
author: mdecrevoisier
status: experimental
logsource:
product: windows
category: process_creation
detection:
selection_wsl_activation_modern: # wsl --install
CommandLine|contains|all:
- wsl
- '--install'
selection_wsl_activation_deprecated: # dism.exe /online /enable-feature /featurename:Microsoft-Windows-Subsystem-Linux /all /norestart
NewProcessName|endswith: '\dism.exe'
CommandLine|contains|all:
- Enable-feature
- Microsoft-Windows-Subsystem-Linux
condition: selection_wsl_activation_modern or selection_wsl_activation_deprecated
falsepositives:
- developer computer (with Visual Studio Code)
- administrator activity
level: medium
Stages and Predicates
Stage 0: condition
selection_wsl_activation_modern or selection_wsl_activation_deprecatedStage 1: selection_wsl_activation_modern
selection_wsl_activation_modern:
CommandLine|contains|all:
- wsl
- '--install'
Stage 2: selection_wsl_activation_deprecated
selection_wsl_activation_deprecated:
NewProcessName|endswith: '\dism.exe'
CommandLine|contains|all:
- Enable-feature
- Microsoft-Windows-Subsystem-Linux
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
NewProcessName | ends_with |
| field:"Image" kind:ends_with value:"\dism.exe" |