Windows Process Creation: NTVDM (ntvdm.exe/csrstub.exe) Start for 16-bit App Compatibility
Flags creation of NTVDM-related processes (ntvdm.exe or csrstub.exe) used to run legacy 16-bit/DOS applications on Windows.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-07-16
- Updated
- 2026-07-30
What it detects
This rule matches process creation events where the image path ends with ntvdm.exe or csrstub.exe. These binaries are associated with NT Virtual DOS Machine support for running legacy DOS and 16-bit Windows applications, which can enable unusual execution paths on 32-bit systems. Attackers may misuse compatibility layers to run legacy components or evade controls, so process start telemetry is used to flag these execution attempts reliably.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/compatibility/ntvdm-and-16-bit-app-support
- support.microsoft.comhttps://support.microsoft.com/fr-fr/topic/an-ms-dos-based-program-that-uses-the-ms-dos-protected-mode-interface-crashes-on-a-computer-that-is-running-windows-7-5dc739ea-987b-b458-15e4-d28d5cca63c7
- app.any.runhttps://app.any.run/tasks/93fe92fa-8b2b-4d92-8c09-a841aed2e793/
- app.any.runhttps://app.any.run/tasks/214094a7-0abc-4a7b-a564-1b757faed79d/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_16bit_application.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-ntvdm-ntvdm-exe-csrstub-exe-start-for-16-bit-app-compat-16905e21
title: "Windows Process Creation: NTVDM (ntvdm.exe/csrstub.exe) Start for 16-bit App Compatibility"
id: c89c3ef2-b70b-4f87-96d9-e5bdc492f4f1
status: test
description: This rule matches process creation events where the image path ends with ntvdm.exe or csrstub.exe. These binaries are associated with NT Virtual DOS Machine support for running legacy DOS and 16-bit Windows applications, which can enable unusual execution paths on 32-bit systems. Attackers may misuse compatibility layers to run legacy components or evade controls, so process start telemetry is used to flag these execution attempts reliably.
references:
- https://learn.microsoft.com/en-us/windows/compatibility/ntvdm-and-16-bit-app-support
- https://support.microsoft.com/fr-fr/topic/an-ms-dos-based-program-that-uses-the-ms-dos-protected-mode-interface-crashes-on-a-computer-that-is-running-windows-7-5dc739ea-987b-b458-15e4-d28d5cca63c7
- https://app.any.run/tasks/93fe92fa-8b2b-4d92-8c09-a841aed2e793/
- https://app.any.run/tasks/214094a7-0abc-4a7b-a564-1b757faed79d/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_16bit_application.yml
author: frack113, Huntrule Team
date: 2022-07-16
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \ntvdm.exe
- \csrstub.exe
condition: selection
falsepositives:
- Legitimate use
level: medium
license: DRL-1.1
related:
- id: 16905e21-66ee-42fe-b256-1318ada2d770
type: derived