This detection identifies the presence of Borland C++ compiler artifacts within the environment, which often indicate legitimate development activity but can also signal an adversary leveraging custom-compiled tools for code injection or persistence. A proactive hunt is essential to distinguish these benign signatures from potential malicious binaries that mimic standard compiler outputs to evade initial security controls in Azure Sentinel.
rule FSGv110EngdulekxtBorlandC
{
meta:
author="malware-lu"
strings:
$a0 = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 [2] 00 0F B6 C9 EB 02 CD 20 BB }
$a1 = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 [2] 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA }
condition:
$a0 at pe.entry_point or $a1 at pe.entry_point
}
This YARA rule can be deployed in the following contexts:
This rule contains 2 string patterns in its detection logic.
Here are 4 specific false positive scenarios for the FSGv110EngdulekxtBorlandC detection rule, which targets Borland C++ runtime components often found in legacy enterprise applications:
Scenario: Automated Deployment of Legacy ERP Modules via SCCM
borlndmm.dll or similar runtime components, triggering the YARA rule.ccmexec.exe (SCCM Agent) AND the file path contains \Microsoft\CCM\ or matches a specific SCCM application ID associated with the ERP suite.Scenario: Scheduled Backup of Borland Database Client Libraries
bde.dll or borlndmm.dll files within the installation folder (C:\Program Files (x86)\Common Files\Borland).VeeamTransport.exe, VeeamService.exe, or vbruntime.exe when the accessed file path starts with C:\Program Files (x86)\Common Files\Borland.Scenario: Antivirus Real-Time Scanning of Development Environments