Sigma rule: Potential WSL InstallLocation Registry Key Modification

Rule

Title

Potential WSL InstallLocation Registry Key Modification

Status

experimental

Level

medium

Author

Liran Ravich, Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-05-05

File

rules/windows/registry/registry_set/registry_set_wsl_installlocation_registry_key_modification.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects modifications to the Windows Subsystem for Linux (WSL) InstallLocation registry key.
Attackers can modify this registry key to redirect the execution flow of legitimate WSL processes (wsl.exe or bash.exe) to a malicious payload, acting as a proxy execution and defense evasion technique.

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|contains: '\Lxss\MSI\InstallLocation'
filter_main_legitimate_binary:
    - Details:
          - 'C:\Program Files\WSL'
          - '%ProgramFiles%\WSL'
    - Details|contains:
          - ':\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_'
          - '\AppData\Local\Microsoft\WindowsApps'
          - '%ProgramFiles%\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_'
filter_main_msiexec:
    Image:
        - 'C:\Windows\System32\msiexec.exe'
        - 'C:\Windows\SysWOW64\msiexec.exe'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.stealth
• attack.defense-impairment
• attack.persistence
• attack.t1112
• attack.t1218

MITRE ATT&CK ids this rule names

• T1112
• T1218

Related rules

• f9f62824-de4e-40ca-afe7-8358f76a876d (similar)

References

• https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
• https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
• https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
• https://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
• https://learn.microsoft.com/en-us/windows/wsl/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_wsl_installlocation_registry_key_modification.yml