FSGv110EngdulekxtBorlandC1999

Hunt Hypothesis

This detection identifies potential legacy Borland C++ 1999 compiler artifacts or associated malware signatures within the environment using a specialized YARA rule. The SOC team should proactively hunt for these indicators to uncover dormant threats or unauthorized legacy software that may introduce vulnerabilities in the Azure Sentinel ecosystem.

YARA Rule

rule FSGv110EngdulekxtBorlandC1999
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 CD 20 2B C8 68 80 [2] 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the FSGv110EngdulekxtBorlandC1999 detection rule, which targets legacy Borland C++ 1999 artifacts often found in older enterprise applications:

• Legacy ERP Maintenance Scripts:

  • Scenario: Scheduled nightly maintenance jobs for a custom ERP system (e.g., SAP or Oracle) written with the Borland C++ 5.0 compiler execute batch scripts that instantiate legacy DLLs matching the rule’s signature. These often run via Windows Task Scheduler under the SYSTEM account.
  • Filter/Exclusion: Exclude processes where the command line contains specific ERP maintenance keywords (e.g., maintenance.exe, batch_job_erp) and the user context is NT AUTHORITY\SYSTEM. Alternatively, exclude file paths residing in dedicated legacy application directories like C:\Program Files\LegacyERP\Bin\.

• Antivirus Engine Scanning of Archived Data:

  • Scenario: Enterprise Antivirus solutions (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) perform deep scans on archived data repositories containing historical backups. During the scan, the AV engine extracts and executes legacy Borland-based compression utilities embedded within the archives, triggering the YARA rule.
  • Filter/Exclusion: Create an exclusion based on the parent process name (e.g., C:\Program Files\CrowdStrike\fs_qa.exe or MsMpEng.exe) when the child process matches the Borland signature. This ensures that scanning activities do not generate alerts for the scanned content itself.

• DevOps Build Pipeline Execution:

  • Scenario: CI/CD pipelines (e.g., Jenkins or Azure DevOps) running on build agents utilize a legacy compiler toolchain to compile test suites. The build agent executes bcpp.exe or similar Bor