Assessment of the Transparency of the Windows Subsystem for Linux (WSL)

Malware and benign software alike tries to protect itself by identifying the execution environment. One such execution environment, the Windows Subsystem for Linux is an important step towards interoperability by allowing the execution of ELF binaries in Windows.This paper lists vectors for an application to discover if it runs inside of WSL. A prototype implementation proves the applicability and feasibility of several deviations, including environmental artifacts, unique features and the non-implementation of system calls, for the differentiation.The results show that the prototype application is capable of distinguishing between the WSL and Ubuntu environment.