fix: Execution Of Non-Existing File - add vmmemWSL exception

Author: munzzyy

rules/windows/process_creation/proc_creation_win_susp_image_missing.yml

@@ -6,7 +6,7 @@ references:
     - https://pentestlaboratories.com/2021/12/08/process-ghosting/
 author: Max Altgelt (Nextron Systems)
 date: 2021-12-09
-modified: 2022-12-14
+modified: 2026-07-05
 tags:
     - attack.stealth
 logsource:
@@ -27,10 +27,12 @@ detection:
               - 'Registry'
               - 'MemCompression'
               - 'vmmem'
+              - 'vmmemWSL'
         - CommandLine:
               - 'Registry'
               - 'MemCompression'
               - 'vmmem'
+              - 'vmmemWSL'
     condition: not image_absolute_path and not 1 of filter*
 falsepositives:
     - Unknown