Windows Process Creation: NTVDM (ntvdm.exe/csrstub.exe) Start for 16-bit App Compatibility

title: "Windows Process Creation: NTVDM (ntvdm.exe/csrstub.exe) Start for 16-bit App Compatibility"
id: c89c3ef2-b70b-4f87-96d9-e5bdc492f4f1
status: test
description: This rule matches process creation events where the image path ends with ntvdm.exe or csrstub.exe. These binaries are associated with NT Virtual DOS Machine support for running legacy DOS and 16-bit Windows applications, which can enable unusual execution paths on 32-bit systems. Attackers may misuse compatibility layers to run legacy components or evade controls, so process start telemetry is used to flag these execution attempts reliably.
references:
  - https://learn.microsoft.com/en-us/windows/compatibility/ntvdm-and-16-bit-app-support
  - https://support.microsoft.com/fr-fr/topic/an-ms-dos-based-program-that-uses-the-ms-dos-protected-mode-interface-crashes-on-a-computer-that-is-running-windows-7-5dc739ea-987b-b458-15e4-d28d5cca63c7
  - https://app.any.run/tasks/93fe92fa-8b2b-4d92-8c09-a841aed2e793/
  - https://app.any.run/tasks/214094a7-0abc-4a7b-a564-1b757faed79d/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_16bit_application.yml
author: frack113, Huntrule Team
date: 2022-07-16
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \ntvdm.exe
      - \csrstub.exe
  condition: selection
falsepositives:
  - Legitimate use
level: medium
license: DRL-1.1
related:
  - id: 16905e21-66ee-42fe-b256-1318ada2d770
    type: derived