One WSL BOF to Rule Them All

The post describes how adversaries can leverage Windows Subsystem for Linux 2 (WSL2) as a low-visibility enclave and introduces an open-source Beacon Object File that executes commands within WSL2 across multiple versions by dynamically selecting the correct COM interface. It summarizes the reverse-engineering approach used to extract interface definitions from proxy stubs, addresses versioning challenges, and provides a tool to enumerate WSL distros and run commands, emphasizing operational implications for both attackers and defenders.