Windows Subsystem for Linux (WSL/WSL2) running a Carbon Black Cloud Sensor

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Does the Carbon Black Cloud Linux sensor work with WSL/WSL2?

Environment

• Carbon Black Cloud Sensor: All Versions
• Microsoft Windows 10 version 1607 and Higher
• Microsoft Windows Server 2019
• Windows Subsystem for Linux (WSL/WSL2): Ubuntu All Versions

Cause

The Ubuntu 24.04.3 LTS kernel reported in WSL2 (6.6.87.2‑microsoft‑standard‑WSL2) is not explicitly listed in the current OER, and while the wording about “kernel versions prior to the specified version” suggests that earlier kernels in the same family may work, this does not override the fact that WSL2 uses a custom Microsoft kernel and is not currently called out as a supported platform.

Resolution

No, full support of WSL/WSL2 with the sensor is not available.

Additional Information

• Since WSL is a file structure, the sensor may still block malicious events based on policies
• The sensor cannot recognize and track the underlying Linux executables and scripts nor assign reputation consistently