diff --git a/src/detection/terminalshell/terminalshell_windows.c b/src/detection/terminalshell/terminalshell_windows.c
index aa38e0075..0bd65e578 100644
--- a/src/detection/terminalshell/terminalshell_windows.c
+++ b/src/detection/terminalshell/terminalshell_windows.c
@@ -305,6 +305,7 @@ static uint32_t getTerminalInfo(FFTerminalShellResult* result, uint32_t pid)
         ffStrbufIgnCaseEqualS(&result->terminalPrettyName, "nu")             ||
         ffStrbufIgnCaseEqualS(&result->terminalPrettyName, "powershell")     ||
         ffStrbufIgnCaseEqualS(&result->terminalPrettyName, "powershell_ise") ||
+        ffStrbufIgnCaseEqualS(&result->terminalPrettyName, "wsl")            || // running inside wsl
         ffStrbufStartsWithIgnCaseS(&result->terminalPrettyName, "ConEmuC") // wrapper process of ConEmu
     ) {
         //We are nested shell