DOS Message Check

Hunt Hypothesis

This rule detects potential denial-of-service activity or misconfigured service endpoints by identifying specific error messages or status codes indicative of resource exhaustion or connectivity failures. Proactively hunting for these signals allows the SOC team to distinguish between transient network glitches and targeted availability attacks, ensuring rapid remediation before minor issues escalate into significant service outages.

YARA Rule

rule HasModified_DOS_Message : PECheck
{
	meta: 
		author = "_pusher_"
		description = "DOS Message Check"
		date="2016-07"
	strings:	
		$a0 = "This program must be run under Win32" wide ascii nocase
		$a1 = "This program cannot be run in DOS mode" wide ascii nocase
		//UniLink
		$a2 = "This program requires Win32" wide ascii nocase
		$a3 = "This program must be run under Win64" wide ascii nocase
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and not
		(for any of ($a*) : ($ in (0x0..uint32(0x3c) )))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy application or internal microservice uses the DOSKEY command in a batch script or PowerShell wrapper to create a macro history for debugging purposes during a scheduled maintenance window.
  • Filter/Exclusion: Exclude events where the parent process is cmd.exe or powershell.exe and the command line contains DOSKEY but does not contain MACRO or LIST, or specifically exclude if the parent process is a known build agent (e.g., jenkins.exe, teamcity.exe) or a scheduled task service (svchost.exe with a specific task name).
• Scenario: An administrator runs a custom PowerShell script to audit system configuration that explicitly invokes doskey /list to verify macro definitions or checks for unexpected DOS-level command aliases introduced by a third-party tool.
  • Filter/Exclusion: Exclude if the command line matches doskey /list or doskey /history (read-only operations) rather than doskey <macro_name> = <command>, and ensure the parent process is powershell.exe or pwsh.exe with a known script path (e.g., C:\Scripts\Audit\CheckDoskey.ps1).
• Scenario: A containerized application (e.g., a Windows-based CI/CD agent or a legacy Java application) runs in a container with a minimal CMD shell that initializes DOS macros for internal command shortcuts as part of its entrypoint script.
  • Filter/Exclusion: Exclude if the process is running within a container context (identified by a specific CommandLine pattern like --name or a container ID in the process path) or if the parent process is docker.exe, containerd.exe, or com.docker.backend.exe.
• Scenario: A system restore or backup utility (e.g., Vee