Start of NT Virtual DOS Machine

calendar Aug 12, 2024 · attack.defense-evasion  ·
Share on: linkedin copy

Ntvdm.exe allows the execution of 16-bit Windows applications on 32-bit Windows operating systems, as well as the execution of both 16-bit and 32-bit DOS applications

Sigma rule (View on GitHub)

 1title: Start of NT Virtual DOS Machine
 2id: 16905e21-66ee-42fe-b256-1318ada2d770
 3status: test
 4description: Ntvdm.exe allows the execution of 16-bit Windows applications on 32-bit Windows operating systems, as well as the execution of both 16-bit and 32-bit DOS applications
 5references:
 6    - https://learn.microsoft.com/en-us/windows/compatibility/ntvdm-and-16-bit-app-support
 7    - https://support.microsoft.com/fr-fr/topic/an-ms-dos-based-program-that-uses-the-ms-dos-protected-mode-interface-crashes-on-a-computer-that-is-running-windows-7-5dc739ea-987b-b458-15e4-d28d5cca63c7
 8    - https://app.any.run/tasks/93fe92fa-8b2b-4d92-8c09-a841aed2e793/
 9    - https://app.any.run/tasks/214094a7-0abc-4a7b-a564-1b757faed79d/
10author: frack113
11date: 2022-07-16
12modified: 2022-07-16
13tags:
14    - attack.defense-evasion
15logsource:
16    category: process_creation
17    product: windows
18detection:
19    selection:
20        Image|endswith:
21            - '\ntvdm.exe'
22            - '\csrstub.exe'
23    condition: selection
24falsepositives:
25    - Legitimate use
26level: medium

References

Related rules

to-top