WSL2 Blind Spot: DllHost.exe File Creates Without Sysmon Network Events
Detects instances where DllHost.exe creates or writes files in sensitive directories (Users, ProgramData, Windows\Temp) without any associated network connection events (Sysmon EID 3). This pattern is consistent with potential WSL2 proxied file operations where the network connection originates within a virtual machine and is invisible to standard Windows host telemetry, potentially masking malicious activity.
Splunk (SPL)
