This rule identifies the presence of a legacy DOS extender component from 1994, which may indicate the execution of outdated or embedded 16-bit applications that could serve as a vector for privilege escalation or compatibility-based attacks. Proactively hunting for this artifact helps the SOC team uncover potential supply chain compromises or legacy software dependencies that lack modern security controls within the Azure Sentinel environment.
rule DOS_Extender_by_Doug_Hoffmann_1994: PEiD
{
strings:
$a = { 16 53 66 5B 72 EC 3B C8 75 E8 36 66 89 36 D2 01 57 36 8B 3E 00 00 8B 0E 06 00 8B 36 18 00 66 C1 CB 10 66 0F B7 C3 8B D0 AD 8B 1C 3B DF 0F 8D 08 00 03 DA 8E C3 26 67 01 10 83 C6 02 E2 EA B4 0F CD 10 2E A2 00 00 5F 16 1F 66 8F 06 D6 01 66 8F }
condition:
$a at pe.entry_point
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Legacy DOS Application Compatibility Layer (DOSBox/Wine)
INV95.EXE) via DOSBox or Wine on a jump server to perform end-of-year data reconciliation. The DOS extender is loaded as part of the compatibility layer to support the 16-bit application, triggering the YARA rule on the process or loaded module.dosbox.exe or wine64.exe/wine32.exe, or exclude file paths containing \DOSBox\ or \Wine\ in the executable directory.Embedded DOS Extender in Legacy Installers (e.g., Old Oracle/SQL Server Patches)
sp3setup.exe). The installer includes a DOS extender to handle 16-bit components or legacy driver installation, which is temporarily loaded into memory during the install process.setup.exe, msiexec.exe) and the file name matches known legacy patch patterns (e.g., sp*.exe, patch*.exe), or exclude if the process command line contains /i or /install.Legacy BIOS/UEFI Firmware Update Utilities
AFUUTIL.EXE from American Megatrends or AMIFLASH.EXE) on a server. These utilities often include DOS extenders to interface with low-level firmware components or legacy hardware registers