Suspicious WSL InstallLocation Registry Key Modification Via CommandLine

title: Suspicious WSL InstallLocation Registry Key Modification Via CommandLine
id: f9f62824-de4e-40ca-afe7-8358f76a876d
related:
    - id: 83475063-b1c8-4774-9568-69bbda71a539
      type: similar
status: experimental
description: |
    Detects the use of reg.exe or PowerShell to modify the WSL InstallLocation registry key via command-line arguments.
    Legitimate modifications to this key are performed exclusively by the Windows Installer (msiexec.exe) during WSL package installation or update.
    Manual use of reg.exe or PowerShell to set this value strongly indicates an attempt to redirect WSL execution to a malicious binary.
references:
    - https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
    - https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
    - https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
    - https://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
    - https://learn.microsoft.com/en-us/windows/wsl/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-05-05
tags:
    - attack.stealth
    - attack.defense-impairment
    - attack.persistence
    - attack.t1112
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
              - '\reg.exe'
        - OriginalFileName:
              - 'powershell.exe'
              - 'pwsh.dll'
              - 'reg.exe'
    selection_cli_action:
        CommandLine|contains:
            - ' add '           # reg.exe add subcommand
            - 'New-ItemProperty'
            - 'Set-ItemProperty'
            - 'sp '             # PowerShell alias for Set-ItemProperty
    selection_cli_key:
        CommandLine|contains:
            - '\Lxss\MSI'
            - '/Lxss/MSI'       # forward-slash variant sometimes used with PowerShell paths
    selection_cli_value:
        CommandLine|contains: 'InstallLocation'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wsl_installlocation_modification_via_cmdline/info.yml