As an update to the #ShadowBunny thread - WSL is now being abused by a ransomware threat actor.

WSL opens up a whole attack surface on Windows. The Defender EDR integration is crap, and an optional bolt on.. and other EDR providers have basically no visibility. It’s a mess.

https://www.bleepingcomputer.com/news/security/qilin-ransomware-abuses-wsl-to-run-linux-encryptors-in-windows/

The #ShadowBunny vulnerability in MDE persists over 6 months later - if you contain an endpoint in MDE, Windows Subsystem for Linux apps can all still access the internet.

So if you’re a threat actor, enable WSL from control panel and SSH back to yourself - if the org detects you, your access persists. It also allows internal network access, too.
https://infosec.exchange/@nieldk/111241070277583473