Identify endpoints that run WSL
Identify Endpoints Running Wsl
Query
DeviceProcessEvents
| where ActionType has "ProcessCreated"
| where ProcessVersionInfoOriginalFileName has "wsl.exe"
| where ProcessVersionInfoFileDescription has "Windows Subsystem for Linux"
| summarize by DeviceNameAbout this query
Identify endpoints that run WSL
Description
The following query will identify endpoints running Windows Subsystem for Linux (WSL).
Microsoft Sentinel & Defender XDR
Versioning
| Version | Date | Comments |
|---|---|---|
| 1.0 | 15/06/2024 | Initial publish |
Explanation
This query identifies endpoints that are running Windows Subsystem for Linux (WSL) by looking for processes with the file name "wsl.exe" and description "Windows Subsystem for Linux".