WSL Containers Goes GA: Securing Linux Containers on Windows Endpoints Against Developer-Targeted Abuse

---
title: Suspicious WSL Command Execution via wsl.exe
id: 8f2c4a91-3b7d-4e15-a6c9-2d1e5f7b9a04
status: experimental
description: Detects wsl.exe invoked with inline command execution flags or shell interpreters, a common defense-evasion and payload-execution pattern used to run Linux tooling from a signed Microsoft binary.
references:
  - https://attack.mitre.org/techniques/T1202/
  - https://attack.mitre.org/techniques/T1027/
  - https://www.bleepingcomputer.com/news/microsoft/microsoft-is-rolling-out-linux-container-support-to-wsl/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\wsl.exe'
      - '\wslhost.exe'
  selection_cli:
    CommandLine|contains:
      - ' -e '
      - '--exec'
      - 'bash -c'
      - 'sh -c'
      - '/bin/bash'
      - '/bin/sh'
      - 'curl '
      - 'wget '
      - 'chmod +x'
  filter_dev:
    CommandLine|contains:
      - 'code '
      - 'docker '
      - 'git '
  condition: selection_image and selection_cli and not filter_dev
falsepositives:
  - Developer workflows invoking WSL shells interactively
  - VS Code Remote-WSL extensions
level: medium
---
title: WSL Execution from Uncommon Parent Process
id: 3e9b1d47-6a2f-4c83-b5e1-7d4a9f2c8e15
status: experimental
description: Detects wsl.exe spawned by Office applications, script interpreters, or other non-interactive parents — a strong indicator of phishing-delivered or malware-driven WSL abuse rather than legitimate developer use.
references:
  - https://attack.mitre.org/techniques/T1202/
  - https://www.bleepingcomputer.com/news/microsoft/microsoft-is-rolling-out-linux-container-support-to-wsl/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith: '\wsl.exe'
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
  condition: selection_image and selection_parent
falsepositives:
  - Scripted developer environment bootstrap (should be inventoried and tuned per-environment)
level: high
---
title: WSL Container Runtime Execution from Windows Host
id: 5a1d8f63-9c4b-4e27-a3f6-1b8e2d7c4a96
status: experimental
description: Detects container runtime commands (docker/podman/containerd) invoked through wsl.exe from the Windows host, indicating container operations inside WSL that may bypass Windows-native monitoring.
references:
  - https://attack.mitre.org/techniques/T1610/
  - https://attack.mitre.org/techniques/T1195.001/
  - https://www.bleepingcomputer.com/news/microsoft/microsoft-is-rolling-out-linux-container-support-to-wsl/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.defense_evasion
  - attack.t1610
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith: '\wsl.exe'
  selection_cli:
    CommandLine|contains:
      - 'docker run'
      - 'docker pull'
      - 'docker exec'
      - 'docker build'
      - 'podman run'
      - 'nerdctl run'
      - 'ctr run'
  condition: selection_image and selection_cli
falsepositives:
  - Legitimate developer container workflows — inventory authorized usage and alert on deviations
level: medium

// Hunt: WSL abuse patterns on Windows endpoints — last 14 days
// Covers LOLBin-style wsl.exe execution, suspicious parents, and container operations
let Lookback = 14d;
DeviceProcessEvents
| where TimeGenerated >= ago(Lookback)
| where FileName in~ ("wsl.exe", "wslhost.exe", "bash.exe")
| extend SuspiciousParent = InitiatingProcessFileName in~ (
    "winword.exe","excel.exe","powerpnt.exe","outlook.exe","mshta.exe",
    "wscript.exe","cscript.exe","rundll32.exe","regsvr32.exe","powershell.exe","pwsh.exe","cmd.exe")
| extend SuspiciousCmd = ProcessCommandLine has_any (
    "bash -c","sh -c"," --exec "," -e ","curl ","wget ","chmod +x",
    "docker run","docker pull","docker exec","podman run","/mnt/c/Users")
| where SuspiciousParent or SuspiciousCmd
| project TimeGenerated, DeviceName, AccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, SHA256, ReportId
| sort by TimeGenerated desc

// Hunt: Baseline deviation — devices running WSL for the first time in 30 days
// New WSL activity on a device with no history is a strong anomaly signal
let History = DeviceProcessEvents
    | where TimeGenerated between (ago(60d) .. ago(30d))
    | where FileName =~ "wsl.exe"
    | summarize by DeviceName;
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName =~ "wsl.exe"
| where DeviceName !in (History)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            InvocationCount = count(), Users = make_set(AccountName),
            SampleCmds = make_set(ProcessCommandLine, 5) by DeviceName
| sort by FirstSeen desc

-- Velociraptor hunt: enumerate live WSL processes and interrogate WSL configuration artifacts
-- Deploy across developer workstation fleet

-- Part 1: Live WSL/container process execution with command lines
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)wsl|bash|docker|containerd|podman'
   OR CommandLine =~ '(?i)wsl.*(-e|--exec|bash -c|sh -c)'

-- Part 2: WSL user configuration files (persistence-relevant — .wslconfig controls VM behavior)
SELECT FullPath, Size, Mtime AS Modified
FROM glob(globs='C:\\Users\\*\\.wslconfig')

-- Part 3: WSL registry state — confirm which distributions are installed per machine
SELECT Name, FullPath
FROM glob(globs='HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Lxss\\*\\*',
          accessor='registry')

# WSL Container Attack Surface Audit & Hardening — run elevated, deploy via Intune/SCCM
# Part 1: Enumerate WSL state on the endpoint
Write-Host "=== WSL Feature State ===" -ForegroundColor Cyan
Get-WindowsOptionalFeature -Online |
  Where-Object { $_.FeatureName -in 'Microsoft-Windows-Subsystem-Linux','VirtualMachinePlatform' } |
  Select-Object FeatureName, State | Format-Table -AutoSize

# Part 2: List installed WSL distributions and versions
Write-Host "=== Installed Distributions ===" -ForegroundColor Cyan
try { wsl.exe --list --verbose } catch { Write-Host "WSL not present or not invocable." }

# Part 3: Check for user-level .wslconfig files (should be baselined/monitored)
Write-Host "=== .wslconfig Files ===" -ForegroundColor Cyan
Get-ChildItem 'C:\Users\*\.wslconfig' -ErrorAction SilentlyContinue |
  Select-Object FullName, LastWriteTime | Format-Table -AutoSize

# Part 4: Report recent wsl.exe executions from Defender telemetry (local check)
Write-Host "=== Recent WSL Process Activity (Event 4688 requires audit policy) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 5000 -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'wsl\.exe|wslhost\.exe' } |
  Select-Object -First 20 TimeCreated, Message | Format-List

# Part 5: Hardening — disable WSL entirely on machines where it is NOT required
# Uncomment to enforce:
# Disable-WindowsOptionalFeature -Online -FeatureName 'Microsoft-Windows-Subsystem-Linux' -NoRestart
# Disable-WindowsOptionalFeature -Online -FeatureName 'VirtualMachinePlatform' -NoRestart

# Part 6: Verify MDE WSL plug-in presence (Linux-side telemetry coverage)
Write-Host "=== MDE WSL Plug-in Check ===" -ForegroundColor Cyan
if (Test-Path "$env:ProgramFiles\Microsoft Defender for Endpoint plug-in for WSL") {
  Write-Host "MDE WSL plug-in installed — Linux-side telemetry available."
} else {
  Write-Warning "MDE WSL plug-in NOT found. WSL/container activity is a telemetry blind spot."
}