Windows Binary Executed From WSL — Detection Rule

Detects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child relationships