Potential WSL InstallLocation Registry Key Modification

title: Potential WSL InstallLocation Registry Key Modification
id: 83475063-b1c8-4774-9568-69bbda71a539
related:
    - id: f9f62824-de4e-40ca-afe7-8358f76a876d
      type: similar
status: experimental
description: |
    Detects modifications to the Windows Subsystem for Linux (WSL) InstallLocation registry key.
    Attackers can modify this registry key to redirect the execution flow of legitimate WSL processes (wsl.exe or bash.exe) to a malicious payload, acting as a proxy execution and defense evasion technique.
references:
    - https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
    - https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
    - https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
    - https://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
    - https://learn.microsoft.com/en-us/windows/wsl/
author: Liran Ravich, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-05-05
tags:
    - attack.stealth
    - attack.defense-impairment
    - attack.persistence
    - attack.t1112
    - attack.t1218
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Lxss\MSI\InstallLocation'
    filter_main_legitimate_binary:
        - Details:
              - 'C:\Program Files\WSL'
              - '%ProgramFiles%\WSL'
        - Details|contains:
              - ':\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_'
              - '\AppData\Local\Microsoft\WindowsApps'
              - '%ProgramFiles%\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_'
    filter_main_msiexec:
        Image:
            - 'C:\Windows\System32\msiexec.exe'
            - 'C:\Windows\SysWOW64\msiexec.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_wsl_installlocation_registry_key_modification/info.yml