10th WorldS4 2026

Authors - M. A. M. P. Wanigaratne, K. B. H. M. T. T. Bandaranayake, C. S. Mohottala, J. V. Pannilage
Abstract - Windows Subsystem for Linux (WSL) enables Linux command-line workflows to run directly on Windows endpoints, but this hybrid execution model creates security visibility and interpretation challenges. Host-side monitoring can identify that WSL was launched, but it may not provide sufficient Linux-side command context for threat investigation. This paper presents an explainable WSL command threat detection approach that combines machine learning-based risk scoring with Retrieval-Augmented Large Language Model (LLM) reasoning. The machine learning layer uses wrapper-aware and structure-aware command features to classify WSL-style command activity and convert model output into operational risk scores. The reasoning layer processes suspicious and malicious events using retrieved cybersecurity knowledge to generate analyst-readable explanations, MITRE ATT&CK mappings, confidence reasoning, and suggested defensive actions. The ML component was evaluated using a hybrid command dataset containing 8,028 samples, while the reasoning component was evaluated using 120 sanitized command level scenarios. Results show that the Calibrated SVM achieved 0.96 accuracy and 0.96 malicious class F1-score. Retrieval-augmented reasoning improved MITRE ATT&CK mapping accuracy from 52% to 87% and reduced hallucinated statements from 31% to 12%. The results indicate that combining ML risk scoring with grounded LLM reasoning can improve both alert prioritization and analyst understanding for WSL enabled endpoints.