sigmamediumHunting

Potential WSL InstallLocation Registry Key Modification

Detects modifications to the Windows Subsystem for Linux (WSL) InstallLocation registry key. Attackers can modify this registry key to redirect the execution flow of legitimate WSL processes (wsl.exe or bash.exe) to a malicious payload, acting as a proxy execution and defense evasion technique.

MITRE ATT&CK

T1112 T1218

persistence

Detection Query

selection:
  TargetObject|contains: \Lxss\MSI\InstallLocation
filter_main_legitimate_binary:
  - Details:
      - C:\Program Files\WSL
      - "%ProgramFiles%\\WSL"
  - Details|contains:
      - :\Program
        Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_
      - \AppData\Local\Microsoft\WindowsApps
      - "%ProgramFiles%\\WindowsApps\\MicrosoftCorporationII.WindowsSubsystemFo\
        rLinux_"
filter_main_msiexec:
  Image:
    - C:\Windows\System32\msiexec.exe
    - C:\Windows\SysWOW64\msiexec.exe
condition: selection and not 1 of filter_main_*

Author

Liran Ravich, Swachchhanda Shrawan Poudel (Nextron Systems)

Created

2026-05-05

Data Sources

windowsRegistry Set Events

Platforms

windows

References

Tags

attack.stealthattack.defense-impairmentattack.persistenceattack.t1112attack.t1218

Raw Content

title: Potential WSL InstallLocation Registry Key Modification
id: 83475063-b1c8-4774-9568-69bbda71a539
related:
    - id: f9f62824-de4e-40ca-afe7-8358f76a876d
      type: similar
status: experimental
description: |
    Detects modifications to the Windows Subsystem for Linux (WSL) InstallLocation registry key.
    Attackers can modify this registry key to redirect the execution flow of legitimate WSL processes (wsl.exe or bash.exe) to a malicious payload, acting as a proxy execution and defense evasion technique.
references:
    - https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
    - https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
    - https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
    - https://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
    - https://learn.microsoft.com/en-us/windows/wsl/
author: Liran Ravich, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-05-05
tags:
    - attack.stealth
    - attack.defense-impairment
    - attack.persistence
    - attack.t1112
    - attack.t1218
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Lxss\MSI\InstallLocation'
    filter_main_legitimate_binary:
        - Details:
              - 'C:\Program Files\WSL'
              - '%ProgramFiles%\WSL'
        - Details|contains:
              - ':\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_'
              - '\AppData\Local\Microsoft\WindowsApps'
              - '%ProgramFiles%\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_'
    filter_main_msiexec:
        Image:
            - 'C:\Windows\System32\msiexec.exe'
            - 'C:\Windows\SysWOW64\msiexec.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_wsl_installlocation_registry_key_modification/info.yml