Suspicious Execution via Windows Subsystem for Linux

process where host.os.type == "windows" and event.type : "start" and
  (
    (
      (process.executable : "?:\\Windows\\System32\\bash.exe" or ?process.pe.original_file_name == "Bash.exe") and
      not process.command_line : ("bash", "bash.exe")
    ) or
    process.executable : "?:\\Users\\*\\AppData\\Local\\Packages\\*\\rootfs\\usr\\bin\\bash" or
    (
      process.parent.name : "wsl.exe" and process.parent.command_line : "bash*" and not process.name : "wslhost.exe"
    ) or
    (
      process.name : "wsl.exe" and
      (
        process.args : "--system" or
        (
          process.args : "--manage" and process.args : "--set-default-user" and process.args : "root"
        ) or
        (
          (process.args : ("curl", "wget") and process.args : ("http://*", "https://*")) or
          process.args : ("*curl*http://*", "*curl*https://*", "*wget*http://*", "*wget*https://*")
        ) or
        (
          (
            process.args like~ ("*/dev/tcp/*", "*/dev/udp/*", "*zsh/net/tcp*") and
            process.args like ("*&>*", "*<>*", "*>&*", "*<&*")
          ) or
          (
            process.args : ("nc", "netcat", "nc.traditional", "ncat", "*/nc", "*/netcat", "*/nc.traditional", "*/ncat") and
            process.args : ("sh", "/bin/sh", "bash", "/bin/bash") and
            process.args : ("-e", "--exec", "-c", "--sh-exec")
          ) or
          (
            process.args like~ "*socat*" and
            process.args like~ ("*exec:*", "*system:*", "*shell:*") and
            process.args like~ ("*tcp*", "*udp*", "*openssl*")
          )
        ) or
        (
          process.args : ("-e", "--exec") and
          process.args : (
            "/mnt/c/*.exe", "/mnt/c/*.ps1", "/mnt/c/*.bat", "/mnt/c/*.cmd", "/mnt/c/*.vbs", "/mnt/c/*.js",
            "/mnt/c/*.hta"
          ) and
          not process.args : "*wslpath*"
        ) or
        process.args : (
          "*/etc/passwd*", "*/etc/shadow*", "*/etc/sudoers*", "*/etc/sudoers.d/*", "*/root/.ssh/*", "*/home/*/.ssh/*",
          "*/root/.aws/credentials*", "*/home/*/.aws/credentials*", "*/root/.kube/config*", "*/home/*/.kube/config*",
          "*/mnt/c/Windows/System32/config/SAM*",
          "*/mnt/c/Windows/System32/config/SECURITY*",
          "*/mnt/c/Windows/System32/config/SYSTEM", "*/mnt/c/Windows/System32/config/SYSTEM.*",
          "*/mnt/c/Windows/NTDS/ntds.dit*",
          "*/mnt/c/Users/*/AppData/Roaming/Microsoft/Credentials/*",
          "*/mnt/c/Users/*/AppData/Local/Microsoft/Credentials/*",
          "*/mnt/c/Users/*/AppData/Roaming/Microsoft/Protect/*",
          "*/mnt/c/Users/*/.ssh/*",
          "*/mnt/c/Users/*/.aws/credentials",
          "*/mnt/c/Users/*/.azure/*",
          "*/mnt/c/Users/*/.config/gcloud/*",
          "*/mnt/c/Users/*/AppData/Local/Google/Chrome/User Data/*/Login Data*",
          "*/mnt/c/Users/*/AppData/Local/Microsoft/Edge/User Data/*/Login Data*"
        )
      )
    )
  ) and
    not process.parent.executable : ("?:\\Program Files\\Docker\\*.exe", "?:\\Program Files (x86)\\Docker\\*.exe")