Borland Delphi 3 Portions Copyright c 198396 Borland h additional

Hunt Hypothesis

This rule identifies executable files compiled with older versions of Borland Delphi, a framework frequently leveraged by threat actors to create custom malware or trojans that may evade modern signature-based detections. Proactively hunting for these artifacts helps the SOC team uncover low-fidelity or legacy-based malicious payloads that could be used for initial access or lateral movement within the Azure environment.

YARA Rule

rule Borland_Delphi_3_Portions_Copyright_c_198396_Borland_h_additional: PEiD
{
    strings:
        $a = { 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 36 20 42 6F 72 6C 61 6E 64 00 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Intranet Application Maintenance: An IT administrator is performing a scheduled update or patching for a legacy internal inventory management system built in Delphi 3 in the early 1990s. The executable or DLL file contains the specific copyright string, triggering the rule during a file integrity scan or AV full scan.

  • Filter/Exclusion: Exclude files located in the specific application directory (e.g., C:\Apps\LegacyInventory\) or exclude the specific executable name (e.g., InvManager.exe) if it is known to be a trusted, signed legacy binary.

• Third-Party Vendor Tooling: A finance department installs a vendor-provided reporting tool (e.g., “FinReport.exe”) that was developed using Borland Delphi 3. The tool is used for monthly financial consolidation and is not part of the core development stack, but its binary signature matches the YARA rule.

  • Filter/Exclusion: Create a whitelist for known vendor tools by filename (e.g., FinReport.exe) or by digital signature if the vendor signs their binaries. Alternatively, exclude the specific vendor’s installation directory (e.g., C:\Program Files\FinTools\).

• Development Environment Testing: A developer is testing a new build of a legacy component in a local development environment using an older version of the Delphi IDE or a compatible compiler. The test executable or intermediate object files contain the copyright header, triggering alerts during development-phase scans.

  • Filter/Exclusion: Exclude paths associated with development environments, such as C:\Users\<dev_user>\Projects\ or C:\Temp\, or exclude files with extensions like .exe or .dll in directories named build, dist, or test within developer workstations.

• Scheduled Backup or Archival Job: A nightly backup job archives old