Installation of WSL Kali-Linux

Title: Installation of WSL Kali-Linux
Status: experimental
Description:Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL). Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.
References:
  -https://medium.com/@redfanatic7/running-kali-linux-on-windows-51ad95166e6e
  -https://learn.microsoft.com/en-us/windows/wsl/install
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-10-10
modified:None
Tags:

• -'attack.execution'
• -'attack.t1059'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_wsl_img:
Image|endswith:'\wsl.exe' OriginalFileName:'wsl'   selection_wsl_install:
    CommandLine|contains:
      -' --install '
      -' -i '

  selection_wsl_kali:
    CommandLine|contains: 'kali'
  condition:all of selection_wsl_*
Falsepositives:
  -Legitimate installation or usage of Kali Linux WSL by administrators or security teams
Level: high