Windows Subsystem for Linux: Offense & Defense Impact | Qualys
Summary: Qualys researchers tested WSL abuse on two Windows 10 virtual machines (version 20H2, build 19042), one running WSL1 and one WSL2, using PowerShell script block logs, command line process auditing, and Sysmon. They found that enabling WSL requires elevated access and a reboot, placing these techniques in a post-compromise scenario, and that interactive WSL2 shells produce no Windows-visible details of Linux commands because the process runs inside the WSL2 virtual machine.
Bottom line: Both wsl.exe and bash.exe are catalogued as LOLBINs and are signed by Microsoft, so an attacker already on the box can proxy execution through them while your signature checks pass - and on WSL2, an interactive shell leaves Windows with no record of the Linux commands run.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026