topic Re: Identifying Endpoints with WSL Installed from Host Insights in Cortex XDR Discussions

Identifying Endpoints with WSL Installed from Host Insights

michaelsysec242 — Thu, 27 Apr 2023 08:41:52 GMT

Hello all,

is there a way to find all endpoints that have WSL installed on them? Does Host Insights provide this or would I have to run endpoint scripts in order to retrieve this information? If so can someone please provide an examples?

Many thanks

Re: Identifying Endpoints with WSL Installed from Host Insights

anlynch — Fri, 28 Apr 2023 16:05:28 GMT

Hi @michaelsysec242,

I'm doing some research on this. I'll get back to you as soon as I have something.

Re: Identifying Endpoints with WSL Installed from Host Insights

michaelsysec242 — Wed, 24 May 2023 09:31:13 GMT

@anlynch ,

any updates regarding this ?

Re: Identifying Endpoints with WSL Installed from Host Insights

anlynch — Wed, 24 May 2023 13:22:51 GMT

Hey @michaelsysec242,

I installed WSL on my endpoints in a lab and the application did not show up in Host Insights. You may have to look for another way to determine if an endpoint has WSL installed.

You mentioned scripting in your initial post. Currently i'm unaware of a script to do so, but if you create one in python it can be used in the Action Center.

I hope this helps.