WSL Kali-Linux Usage

Title: WSL Kali-Linux Usage
Status: experimental
Description:Detects the use of Kali Linux through Windows Subsystem for Linux
References:
  -https://medium.com/@redfanatic7/running-kali-linux-on-windows-51ad95166e6e
  -https://learn.microsoft.com/en-us/windows/wsl/install
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-10-10
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1202'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img_appdata:
    - Image|contains|all:
      - ':\Users\'
      - '\AppData\Local\packages\KaliLinux'
    - Image|contains|all:
      - ':\Users\'
      - '\AppData\Local\Microsoft\WindowsApps\kali.exe'
  selection_img_windowsapps:
    Image|contains: ':\Program Files\WindowsApps\KaliLinux.'
    Image|endswith: '\kali.exe'
  selection_kali_wsl_parent:
    ParentImage|endswith:
      -'\wsl.exe'
      -'\wslhost.exe'

  selection_kali_wsl_child:
    - Image|contains:
      - '\kali.exe'
      - '\KaliLinux'
    - CommandLine|contains:
      - 'Kali.exe'
      - 'Kali-linux'
      - 'kalilinux'
  filter_main_install_uninstall:
    CommandLine|contains:
      -' -i '
      -' --install '
      -' --unregister '

  condition:1 of selection_img_* or all of selection_kali_* and not 1 of filter_main_*
Falsepositives:
  -Legitimate installation or usage of Kali Linux WSL by administrators or security teams
Level: high