WSL Indirect Command Execution

Use components of the Windows Subsystem for Linux (WSL), such as wsl.exe and bash.exe, to invoke Linux commands or scripts indirectly from Windows (MITRE ATT&CK T1202 / T1059.004). This can bypass endpoint restrictions or detection controls that monitor only standard Windows command interpreters (cmd.exe, powershell.exe) in certain configurations; it does not constitute an inherent or universal EDR bypass. The 2017 Bashware research reflects legacy WSL1-era architecture and should not be generalized to modern WSL2 deployments.