← Back to SOC feed Coverage →

FSGv110EngdulekxtBorlandC

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-08-22T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies the presence of Borland C++ compiler artifacts within the environment, which often indicate legitimate development activity but can also signal an adversary leveraging custom-compiled tools for code injection or persistence. A proactive hunt is essential to distinguish these benign signatures from potential malicious binaries that mimic standard compiler outputs to evade initial security controls in Azure Sentinel.

YARA Rule

rule FSGv110EngdulekxtBorlandC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 [2] 00 0F B6 C9 EB 02 CD 20 BB }
	$a1 = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 [2] 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 2 string patterns in its detection logic.

False Positive Guidance

Here are 4 specific false positive scenarios for the FSGv110EngdulekxtBorlandC detection rule, which targets Borland C++ runtime components often found in legacy enterprise applications:

Original source: https://github.com/Yara-Rules/rules/blob/main/packers/packer.yar