ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™

  • ID: DT124
  • Created: 20th May 2025
  • Updated: 20th May 2025
  • Platform: Windows
  • Contributor: The ITM Team

Installation of New WSL Distributions

Monitor for the registration or installation of new WSL distributions on Windows systems. This may indicate preparation for anti-forensics staging, tool isolation, or evasion of host-based controls by enabling a new, hidden runtime environment.

 

Detection Methods:
Monitor for execution of the following commands:

 

  • wsl --install
  • wsl --import
  • wsl --set-default-version
  • wsl --update

 

Log and alert on new subdirectory creation under %LOCALAPPDATA%\Packages\ matching known Linux distro patterns (e.g., CanonicalGroupLimited.Ubuntu..., Debian..., KaliLinux...).
Monitor Microsoft Store activity related to Linux distributions or track installation events via Windows AppX logs or PowerShell module activity.
Enable Windows Defender Application Control (WDAC), AppLocker, or other control plane policies to restrict execution of unapproved WSL distributions or wsl.exe by unprivileged users.

 

Indicators:
First-time installation of Linux distributions on non-developer endpoints.
Installation of niche or security-focused distributions (e.g., Kali Linux, Parrot OS) by non-security staff.
Rapid creation and deletion of WSL environments.
Distributions installed using --import with local or remote image files.

Sections

ID Name Description
AF022.002Use of Windows Subsystem for Linux (WSL)

The subject leverages Windows Subsystem for Linux (WSL) to contain forensic artifacts within a Linux-like runtime environment embedded in Windows. By operating inside WSL, the subject avoids writing sensitive data, tool activity, or command history to traditional Windows locations, significantly reducing visibility to host-based forensic and security tools.

 

WSL creates a logical Linux environment that appears separate from the Windows file system. Although some host-guest integration exists, activity within WSL often bypasses standard Windows event logging, registry updates, and process tracking. This allows the subject to execute scripts, use Unix-native tools, stage exfiltration, or decrypt payloads with minimal footprint on the host.

 

Example Scenarios:

 

  • The subject downloads and processes sensitive files inside the WSL environment using native Linux tools (e.g., scp, gpg, rsync), preventing access and modification timestamps from appearing in Windows Explorer or standard audit logs.
  • A subject extracts and stages exfiltration material in /mnt/c within WSL, using symbolic links and Linux file permissions to obscure its presence from Windows search and indexing services.
  • WSL is used to execute recon and credential-harvesting scripts (e.g., nmap, hydra, ssh enumeration tools), with no execution trace in Windows Event Logs.
  • Upon completion of activity, the subject deletes the WSL distribution, leaving minimal residue on the host system—especially if no antivirus or EDR coverage extends into the WSL layer.