Microsoft Defender for Endpoint plug-in support for WSL containers (WSLc)
Analysis / inference: Microsoft Defender for Endpoint announces general availability of plug-in support for Windows Subsystem for Linux containers.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Endpoint - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Microsoft has reached General Availability for the Defender for Endpoint plug-in supporting WSL containers (WSLc), providing security visibility via device inventory, alerts, incidents, device timeline, and Advanced Hunting using plugin version 2.26.921.1.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisExtending MDE security visibility into WSL containers enables SOC analysts to investigate and correlate threat activity across both host Windows environments and embedded Linux workloads.
Expands security monitoring capabilities into Linux workloads running inside Windows Subsystem for Linux, adding telemetry to existing MDE workflows without requiring separate tooling.
Section 03 · Recommended actions
- Update MDE plugin deployments to version 2.26.921.1 or higher
- Review Advanced Hunting schemas and query syntax for WSL container activity
- Verify the deployed MDE plugin version is at least 2.26.921.1
- Check Advanced Hunting datasets for telemetry originating from WSL container workloads