Defender for Endpoint WSL2 Plug-in & Hunting Walkthrough

Steps

1. 1

   Step 1: Inspect simulated WSL2 plug-in status and compare with Windows host healthcheck.exe

   On a real Windows 11 host onboarded to Microsoft Defender for Endpoint, the WSL2 plug-in (Minimum build 2004 / KB5007253+ with WSL 2.0.14.0+) runs a Windows-host health check tool. On an onboarded Windows 11 workstation, run:

   & "C:\Program Files\Microsoft Defender for Endpoint Plug-in for WSL\tools\healthcheck.exe"
   

   Because this browser lab runs inside a Linux container rather than a Windows VM, the workspace provides simulated output so you can inspect the fields (PluginStatus, SensorHealth, HostDeviceId, WslDeviceName) before running the real check on a Windows host:

   healthcheck.exe
   

   Notice the [SIMULATED] banner in the Linux shim output and verify that WslDeviceName follows the <HostName>-wslc naming convention (LAB-HOST-wslc).

2. 2

   Step 2: Trigger the simulated DIY Linux EDR test script inside the container

   Run the benign DIY Linux EDR simulation script inside ~/mde-wsl-lab (or click Run DIY Linux EDR Test in the interactive simulator on this page):

   ~/mde-wsl-lab/diy-edr-test.sh --trigger-test-marker
   

   In this Linux container simulation, the script records a local simulated DeviceProcessEvents JSON event rather than submitting a live alert to Defender. On a real onboarded Windows 11 + WSL2 host, validate actual detections in the Microsoft Defender portal (https://security.microsoft.com) under Incidents & alerts and Advanced hunting.

3. 3

   Step 3: Inspect the three Advanced Hunting KQL queries

   Open ~/mde-wsl-lab/hunting-queries.kql in the workspace or step through the 4. Advanced Hunting KQL tab in the simulator above:

   cat ~/mde-wsl-lab/hunting-queries.kql
   

   The three queries cover: (1) listing all WSL2-tagged Linux instances in DeviceInfo with their HostDeviceId column, (2) joining WSL2 instances back to their parent Windows 11 host via DeviceInfo.HostDeviceId, and (3) filtering DeviceProcessEvents across WSL2 devices identified by DeviceInfo.HostDeviceId.

4. 4

   Step 4: Validate the Terraform security management root

   Initialise and validate the Terraform configuration in ~/mde-wsl-lab/main.tf using the offline provider mirror:

   cd ~/mde-wsl-lab
   terraform init -backend=false
   terraform fmt -check
   terraform validate
   

   Submit main.tf to the lab runner to verify the configuration passes offline validation.

   Checked by the agent (terraform-validate): Send main.tf to the terraform-validate runner job to confirm the management configuration validates cleanly with no network access.