WATCOM C 1991 Hint DOS EP

Hunt Hypothesis

This rule identifies executable files compiled with the legacy Watcom C 1991 compiler that exhibit a DOS entry point, a characteristic often seen in older or custom-built malware and rootkits. Proactively hunting for these artifacts helps the SOC team uncover low-and-slow threats or legacy backdoors that may evade modern detection engines by masquerading as benign, outdated software.

YARA Rule

rule WATCOM_C_1991_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? FB B9 ?? ?? 8E C1 BB ?? ?? 83 ?? ?? 83 E3 ?? 26 89 1E ?? ?? 26 8C 1E ?? ?? 03 DC }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Embedded Firmware or BIOS Update Utilities: Many older hardware vendors (e.g., specific Dell, HP, or Lenovo BIOS update tools from the early 2000s) ship with DOS-based executables compiled with Watcom C. These are often stored in shared network drives (\\fileserver\tools\firmware\) or executed by IT staff during scheduled maintenance windows.

  • Filter/Exclusion: Exclude files located in specific firmware/tool directories (e.g., C:\Program Files\VendorTools\, \\server\it\firmware\) or exclude processes initiated by known administrative accounts (e.g., DOMAIN\svc_firmware) from standard user workstations.

• Legacy Mainframe/AS/400 Communication Bridges: Enterprises with legacy mainframes or AS/400 systems often use DOS-based bridge utilities (e.g., old versions of Host Explorer, NetView, or custom C-based socket wrappers) to facilitate data transfer or command execution. These binaries are frequently kept in C:\LegacyApps\ or C:\Tools\mainframe\ and run by specific service accounts or IT operators.

  • Filter/Exclusion: Exclude paths containing keywords like legacy, mainframe, as400, or bridge in the file path, or exclude execution by specific service accounts (e.g., DOMAIN\svc_mainframe_bridge).

• Old-School Antivirus or Disk Utility Scanners: Some older disk imaging tools (e.g., early versions of Norton Ghost, Acronis True Image bootable images, or custom sector editors) or legacy antivirus components use DOS EPs compiled with Watcom. These are often invoked via scheduled tasks for nightly backups or disk integrity checks.

  • Filter/Exclusion: Exclude files with specific known filenames (e.g., ghost.exe, diskutil.exe, `