← Back to SOC feed Coverage →

DOS Extender by Doug Hoffmann 1994

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-09-24T23:00:00Z · Confidence: medium

Hunt Hypothesis

This rule identifies the presence of a legacy DOS extender component from 1994, which may indicate the execution of outdated or embedded 16-bit applications that could serve as a vector for privilege escalation or compatibility-based attacks. Proactively hunting for this artifact helps the SOC team uncover potential supply chain compromises or legacy software dependencies that lack modern security controls within the Azure Sentinel environment.

YARA Rule

rule DOS_Extender_by_Doug_Hoffmann_1994: PEiD
{
    strings:
        $a = { 16 53 66 5B 72 EC 3B C8 75 E8 36 66 89 36 D2 01 57 36 8B 3E 00 00 8B 0E 06 00 8B 36 18 00 66 C1 CB 10 66 0F B7 C3 8B D0 AD 8B 1C 3B DF 0F 8D 08 00 03 DA 8E C3 26 67 01 10 83 C6 02 E2 EA B4 0F CD 10 2E A2 00 00 5F 16 1F 66 8F 06 D6 01 66 8F }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/packers/peid.yar