Arbitrary Command Execution Using WSL — Detection Rule

Detects potential abuse of Windows Subsystem for Linux (WSL) binary as a Living of the Land binary in order to execute arbitrary Linux or Windows commands.

Read the full analysis on IntelFusions