Detect Suspicious Usage of Windows Subsystem for Linux (WSL)

Arnold Chan@slaz

•updated Sep 7, 2026•2•0•1

Detects suspicious activity related to the Windows Subsystem for Linux (WSL), such as installing new distributions (especially penetration testing ones like Kali), importing custom images, or executing commands non-interactively. Attackers may use WSL to run malicious Linux binaries, hide artifacts, and evade defenses.