Suspicious WSL InstallLocation Registry Key Modification Via CommandLine — Detection Rule
Detects the use of reg.exe or PowerShell to modify the WSL InstallLocation registry key via command-line arguments. Legitimate modifications to this key are performed exclusively by the Windows Installer (msiexec.exe) during WSL package installation or update. Manual use of reg.exe or PowerShell to set this value strongly indicates an attempt to redirect WSL execution to a malicious binary.