WSL Kali-Linux Usage

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection_img_appdata": [
    {
      "NewProcessName
| contains
| all": [
        ":\\Users\\",
        "\\AppData\\Local\\packages\\KaliLinux"
      ]
    },
    {
      "NewProcessName
| contains
| all": [
        ":\\Users\\",
        "\\AppData\\Local\\Microsoft\\WindowsApps\\kali.exe"
      ]
    }
  ],
  "selection_img_windowsapps": {
    "NewProcessName
| contains": ":\\Program Files\\WindowsApps\\KaliLinux.",
    "NewProcessName
| endswith": "\\kali.exe"
  },
  "selection_kali_wsl_parent": {
    "ParentProcessName
| endswith": [
      "\\wsl.exe",
      "\\wslhost.exe"
    ]
  },
  "selection_kali_wsl_child": [
    {
      "NewProcessName
| contains": [
        "\\kali.exe",
        "\\KaliLinux"
      ]
    },
    {
      "CommandLine
| contains": [
        "Kali.exe",
        "Kali-linux",
        "kalilinux"
      ]
    }
  ],
  "filter_main_install_uninstall": {
    "CommandLine
| contains": [
      " -i ",
      " --install ",
      " --unregister "
    ]
  },
  "condition": "process_creation and (1 of selection_img_* or all of selection_kali_* and not 1 of filter_main_*)"
}

False Positives

• ⚠ Legitimate installation or usage of Kali Linux WSL by administrators or security teams