Team: Huntress Managed Endpoint Detection and Response (EDR)
Summary: This article provides an overview of how the Huntress Agent detects and reports Windows Subsystem for Linux (WSL) instances on monitored endpoints.
In this Article
- Overview
- Viewing WSL Instances in the Huntress Platform
- Supported WSL Versions and States
-
Frequently Asked Questions (FAQ)
Overview
Windows Subsystem for Linux (WSL) allows users to run a Linux environment directly on Microsoft Windows without the overhead of a traditional virtual machine. The Huntress Agent detects installed WSL instances, registered distributions, and their current execution state on monitored endpoints.
Monitoring WSL distributions ensures visibility into potential security risks or unauthorized environments running within host systems.
Viewing WSL Instances in the Huntress Platform
To view detected WSL distributions for a specific endpoint in the Huntress Platform:
- Log in to Huntress and go to the Endpoints page.
- Select the desired endpoint to open its details view.
- Scroll to the WSL (Windows Subsystem for Linux) section to review detected Linux distributions.
Supported WSL Versions and States
The Huntress Platform captures key attributes for each detected Linux distribution on the host:
| Field | Description | Examples |
|---|---|---|
| Name | The name of the installed Linux distribution and associated Windows user. |
docker-desktop, ubuntu-linux
|
| User / SID | The user account and Security Identifier (SID) under which the WSL instance is registered. |
CREATOR\user1, S-1-5-21-...
|
| Version | The architecture version of the installed distribution. | WSL1, WSL2 |
| State | The current execution status of the distribution instance. | Stopped, Running |
Note: WSL instances listed as Stopped are registered on the endpoint but not currently executing processes in memory.
Frequently Asked Questions (FAQ)
Does Huntress generate detections or security alerts for WSL activity?
No. The WSL monitoring section is currently provided for informational purposes only. Huntress does not currently generate detections or automated security alerts built directly around WSL instance states or distribution registrations.