Detectionmediumtest
Start of NT Virtual DOS Machine
Ntvdm.exe allows the execution of 16-bit Windows applications on 32-bit Windows operating systems, as well as the execution of both 16-bit and 32-bit DOS applications
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic1 selector
detection:
selection:
Image|endswith:
- '\ntvdm.exe'
- '\csrstub.exe'
condition: selectionFalse Positives
Legitimate use
MITRE ATT&CK
Tactics
Rule Metadata
Rule ID
16905e21-66ee-42fe-b256-1318ada2d770
Status
test
Level
medium
Type
Detection
Created
Sat Jul 16
Author
Path
rules/windows/process_creation/proc_creation_win_susp_16bit_application.yml
Raw Tags
attack.defense-evasion