Suspicious Start of NT Virtual DOS Machine (via process_creation)

title: Suspicious Start of NT Virtual DOS Machine (via process_creation)
id: bb989fa7-844a-59a3-8659-eaf5673c2353
status: stable
description: This rule detects Ntvdm.exe enables the execution of 16-bit Windows applications on 32-bit Windows operating systems, as well as the execution of both 16-bit and 32-bit DOS applications
references:
    - https://learn.microsoft.com/en-us/windows/compatibility/ntvdm-and-16-bit-app-support
    - https://support.microsoft.com/fr-fr/topic/an-ms-dos-based-program-that-uses-the-ms-dos-protected-mode-interface-crashes-on-a-computer-that-is-running-windows-7-5dc739ea-987b-b458-15e4-d28d5cca63c7
    - https://app.any.run/tasks/93fe92fa-8b2b-4d92-8c09-a841aed2e793/
    - https://app.any.run/tasks/214094a7-0abc-4a7b-a564-1b757faed79d/
author: Huntrule Team
date: 2026-04-28
tags:
    - attack.stealth
    - attack.defense-evasion
    - attack.t1202
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\ntvdm.exe'
            - '\csrstub.exe'
    condition: selection
falsepositives:
    - Unknown
level: medium