Attackers Abuse WSL2 to Operate Undetected on Windows Systems

The report describes how WSL2 can be abused as a stealthy enclave for attackers: researchers built a Cobalt Strike BOF that uses the WSL COM interface to enumerate WSL2 instances and execute Linux processes without spawning wsl.exe, avoiding common EDR detections. It details versioning and COM marshalling challenges, the use of dynamic IDL reconstruction to support multiple WSL releases, real-world abuse implications (access to unmonitored files, SSH keys, credentials, and internal networks), and recommends treating WSL2 as part of the enterprise attack surface (monitor wsl.exe usage, inspect WSL filesystems, and watch for suspicious COM activity).