From 12a571d588b905f14aac3200251466ac07bb9522 Mon Sep 17 00:00:00 2001
From: Blue <OneBlue@users.noreply.github.com>
Date: Fri, 12 Jul 2024 15:29:44 -0700
Subject: [PATCH] Add logic to catch failed app exec alias executions (#11765)

---
 triage/config.yml | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/triage/config.yml b/triage/config.yml
index d28cc5b4..3c60d2e2 100644
--- a/triage/config.yml
+++ b/triage/config.yml
@@ -99,6 +99,13 @@ rules:
         field3: Wsl/CallMsi/REGDB_E_CLASSNOTREG
       set: msix-bad-install-state
 
+    - logline:
+        provider: Microsoft.Windows.Subsystem.Lxss
+        task: LxssException
+        field1: 'onecore\vm\wsl\lxss\wslutil\liftedsupport.cpp'
+        field5: '0x80070002'
+      set: msix-bad-app-exec-alias-state
+
     - logline:
         provider: Microsoft-Windows-Hyper-V-Chipset
         field1:
@@ -288,9 +295,13 @@ actions:
         condition: msix-install-error
         debug_message: 'Found evidence of MSIX install error: $error, adding msix tag'
         tag: 'msix'
-        
+
+    - when: 
+        condition: msix-bad-app-exec-alias-state
+        debug_message: 'Found evidence of failed app execution alias execution in LiftedSupport'
+
     - when:
-        condition: msix-bad-install-state
+        condition: {or: [msix-bad-install-state, msix-bad-app-exec-alias-state]}
         user_message: | 
             Your WSL installation appears to be in a bad state. Can you try running the following command to reinstall WSL (elevated powershell) and see if that solves the issue?