Arbitrary Command Execution Using WSL
A Sigma rule for process creation on Windows, from SigmaHQ’s threat hunting rules, by oscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems).
medium 2 ATT&CK techniques 1 program it names 1 everyday example trips it
What it looks for
detection:
filter_main_kill:
CommandLine|contains|all:
- ' -d '
- ' -e kill '
ParentImage|endswith: '\cmd.exe'
selection_cli:
CommandLine|contains:
- ' -e '
- ' --exec'
- ' --system'
- ' --shell-type '
- ' /mnt/c'
- ' --user root'
- ' -u root'
- '--debug-shell'
selection_img:
- Image|endswith: '\wsl.exe'
- OriginalFileName: 'wsl.exe'
condition: all of selection_* and not 1 of filter_main_*
The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by oscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.