NT Virtual DOS Machine Process Creation
This rule detects the creation of processes related to the NT Virtual DOS Machine (NTVDM), specifically `ntvdm.exe` and `csrstub.exe`. NTVDM allows 16-bit Windows applications and both 16-bit and 32-bit DOS applications to run on 32-bit Windows operating systems. While NTVDM is a legitimate Windows component, its execution might be unusual in modern environments, especially 64-bit systems where it's not natively supported, and could indicate an attempt to run legacy or potentially malicious 16-bit code.
Sigma
