FSGv120EngdulekxtBorlandC

Hunt Hypothesis

This YARA rule targets executable files compiled with the Borland C compiler, a legacy toolchain frequently utilized by threat actors to create custom malware or obfuscated payloads that may evade modern signature-based detections. Proactively hunting for these artifacts in Azure Sentinel allows the SOC team to identify dormant or low-severity threats that leverage older development environments to blend in with legitimate software, reducing the risk of undetected lateral movement or persistence.

YARA Rule

rule FSGv120EngdulekxtBorlandC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { C1 F0 07 EB 02 CD 20 BE 80 [2] 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Borland Delphi/C++ Builder Application Deployment: Enterprise environments often retain legacy line-of-business applications developed in Borland Delphi or C++ Builder. When IT operations deploy or patch these specific executables (e.g., InventoryApp.exe, LegacyERPClient.exe) across a fleet via Group Policy or SCCM, the YARA rule may flag the binary due to its compiler signature.

  • Filter/Exclusion: Exclude files located in specific legacy application directories (e.g., C:\Program Files\LegacyERP\) or exclude known legacy application names (e.g., *Delphi*.exe, *Borland*.exe) from the detection scope.

• Borland Turbo Pascal/C++ Development Environment Usage: Developers or engineers maintaining legacy codebases may use Borland Turbo Pascal or older versions of C++ Builder for local development or maintenance tasks. The IDE or compiler executables (e.g., bcc32.exe, tp.exe, ide.exe) will match the rule when executed or loaded into memory.

  • Filter/Exclusion: Exclude processes originating from development directories (e.g., C:\Dev\Borland\, C:\Users\<dev>\Documents\Projects\) or exclude specific compiler/IDE process names (e.g., bcc32.exe, tp.exe, ide.exe) if they are running under a developer user account.

• Scheduled Backup or Archiving of Legacy Binaries: Scheduled jobs (e.g., Windows Task Scheduler or cron jobs) that back up or archive old application binaries to network shares or tape storage may trigger the rule if the backup utility (e.g., robocopy.exe, rsync.exe, or a custom script) loads or copies Borland-compiled executables.

  • Filter/Exclusion: Exclude file operations where the source or destination path contains