Potential WSL InstallLocation Registry Key Modification — Detection Rule
Detects modifications to the Windows Subsystem for Linux (WSL) InstallLocation registry key. Attackers can modify this registry key to redirect the execution flow of legitimate WSL processes (wsl.exe or bash.exe) to a malicious payload, acting as a proxy execution and defense evasion technique.