FSGv110EngdulekxtBorlandDelphiBorlandC

Hunt Hypothesis

This detection identifies potential legacy or custom software artifacts compiled with Borland Delphi and C++ by analyzing file signatures via YARA rules to distinguish them from known benign applications. A proactive hunt is essential in Azure Sentinel to uncover hidden persistence mechanisms or obfuscated binaries that may evade standard signature-based defenses due to their use of older development frameworks.

YARA Rule

rule FSGv110EngdulekxtBorlandDelphiBorlandC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E [2] 18 EB 02 AB A0 03 F7 }
	$a1 = { 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E [2] 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 }
	$a2 = { EB 01 2E EB 02 A5 55 BB 80 [2] 00 87 FE 8D 05 AA CE E0 63 EB 01 75 BA 5E CE E0 63 EB 02 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the FSGv110EngdulekxtBorlandDelphiBorlandC detection rule, along with targeted mitigation strategies:

• Legacy ERP Module Updates via Scheduled Service

  • Scenario: A nightly maintenance window triggers an update service (e.g., UpdateService.exe) for a legacy financial system built on Borland Delphi. This service extracts and executes compiled C++ modules that match the rule’s signature, appearing as new executable generation in the application directory (C:\Program Files\LegacyERP\modules).
  • Filter/Exclusion: Create an exclusion based on the parent process name UpdateService.exe running under a specific scheduled task (e.g., \Microsoft\Windows\Tasks\ERP_Nightly_Maintenance) and restrict the scope to the known application path C:\Program Files\LegacyERP\.

• DevOps Pipeline Artifact Deployment

  • Scenario: An internal CI/CD pipeline (using tools like Jenkins or Azure DevOps) deploys a microservice container. The deployment agent extracts a Borland Delphi-based runtime library to the build agent’s temporary workspace (C:\Jenkins\workspace\build-artifacts) before packaging it, triggering the rule on the extracted .exe file.
  • Filter/Exclusion: Exclude files located within the CI/CD build agent directories (e.g., C:\Jenkins\, D:\AzureDevOps\_work\) and filter by parent process names such as java.exe (for Jenkins) or VSTestPlatform.exe.

• Third-Party Antivirus Signature Scanning

  • Scenario: The enterprise endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a heuristic scan on the network share. During the scan, it extracts and analyzes a specific Borland