Suspicious WSL Binary Masquerading — Detection Rule
Detects execution of masqueraded wsl.exe binary. Attackers can rename a malicious payload to wsl.exe to masquerade as the legitimate Windows Subsystem for Linux binary, bypassing detection based on image name alone and abusing user trust in the WSL process name.