Unauthorized WSL2 Execution via Unusual Parent Process (opp-25)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects instances where the Windows Subsystem for Linux (WSL) processes (wsl.exe or wslhost.exe) are spawned by suspicious parent processes, which may indicate an attempt to use WSL for payload execution or persistence on hosts where its usage is restricted or not authorized.