FSGv110EngdulekxtBorlandDelphiMicrosoftVisualCx

Hunt Hypothesis

This detection identifies potential legacy or custom applications utilizing Borland Delphi and Microsoft Visual C++ frameworks that may harbor obfuscated malicious code within their compiled binaries. Proactive hunting for these specific signatures in Azure Sentinel is essential to uncover dormant threats from older development environments that traditional signature-based defenses might overlook due to their low severity classification.

YARA Rule

rule FSGv110EngdulekxtBorlandDelphiMicrosoftVisualCx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 [2] 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the detection rule FSGv110EngdulekxtBorlandDelphiMicrosoftVisualCx, which targets legacy Borland Delphi and Microsoft Visual C++ artifacts often found in enterprise environments:

• Legacy ERP Module Execution

  • Scenario: A scheduled nightly job runs a custom inventory management module built with Borland Delphi 7.0, located within the C:\Program Files\EnterpriseERP\modules directory. The rule triggers because the executable contains specific Delphi runtime signatures and embedded Visual C++ libraries that match the YARA pattern.
  • Filter/Exclusion: Exclude the specific process path: C:\Program Files\EnterpriseERP\modules\*.exe where the file hash matches the known good inventory module, or add a whitelist for the parent process InventoryScheduler.exe.

• DevOps Build Pipeline Compilation

  • Scenario: The CI/CD server (e.g., Jenkins or GitLab Runner) executes a build task that compiles legacy C++ components using Microsoft Visual Studio 2015. During this compilation, temporary binaries with Delphi/C++ headers are generated in the C:\Builds\Temp directory, triggering the rule due to the presence of standard compiler artifacts.
  • Filter/Exclusion: Exclude all file paths containing \Builds\Temp\ or filter based on the parent process name (e.g., java.exe, dockerd.exe) when running under the build service account (svc-build-agent).

• Third-Party Reporting Tool Updates

  • Scenario: An automated update mechanism for a third-party financial reporting suite (developed using Delphi) runs during business hours. The updater extracts temporary installation files that include Visual C++ redistributables, causing the YARA rule to flag these transient files as potential threats.