Windows Defender Flagging WSL As Threat

Question

Something annoying that has started each time I open up Windows Subsystem for Linux 1 (WSL1) is that I get the following notification from Windows Defender (I'm using Windows 10).

It says a threat was detected, called SettingsModifier:Win32/HostsFileHijack. This only has ever occurred when I start using WSL1 (i.e. when I open up the windows terminal). It says the affected item was C:\Users\MYUSERNAME\AppData\Local\Packages\CanonicalGroupLimited.UbuntuonWindows_79rhkp1fndgsc\LocalState\rootfs\etc\hosts

Is there a way I can make this stop complaining each time I start using WSL1? I tried adding the file SettingsModifier:Win32/HostsFileHijack to the exclusions in Windows Defender but when I do it tells me You can't open this location using this program.

Answer 1

WSL usually autogenerates /etc/hosts, and it seems to do so using several sources:

• Some programmatically generated entries for localhost and aliases
• The contents of your Windows host file
• Some IPv6 "nice-to-haves" for localhost and multicast.

It's odd that your WSL /etc/hosts is triggering Windows Defender, but your Windows one is not. Have you by any chance already added C:\Windows\System32\drivers\etc\hosts to the Windows Defender exclusions? Are you using it to suppress Windows telemetry or anything like that?

Edit/Update: Conclusion in the comments is that Spybot Anti-Beacon is likely the culprit that was adding anti-telemetry host entries. This triggers a Windows Defender warning on SettingsModifier:Win32/HostsFileHijack, which is excluded for the Windows host file. However, since the WSL /etc/hosts is auto-generated, it can't be found/opened to be excluded.

At least we can turn off the auto-generation, and you can try to create your own. To turn off auto-generation:

• Inside the WSL instance, create or edit /etc/wsl.conf
• Add the following section:

  [network]
  generateHosts = false
  

• Exit the session
• Run wsl --terminate <distroname> (where is the name of your instance)
• Restart WSL
• Create your own /etc/hosts (preferably as root under sudo) with, at a minimum:

  127.0.0.1    localhost
  127.0.1.1    Yourwindowshostname.local   Your_windows_machine_name
  

  And anything else that you need from your Windows hosts file (if anything), not including, of course, any telemetry blocking entries.

Hopefully that will take care of the error.