Windows Subsystem for Linux (WSL) lets a Windows user run Linux command-line tools and applications through an installed WSL distribution. After access to the Windows host, wsl.exe can invoke a Linux command; Linux processes access Windows files with the permissions of the Windows user who launched WSL. MITRE ATT&CK identifies WSL components as a possible indirect command-execution path (T1202) when used to work around controls that restrict common Windows shells. This behavior depends on the host configuration and security coverage; WSL does not itself provide initial access or automatically bypass privileges.
RESTRICTED_ACCESS_BLUR_MARKER