FSGv120EngdulekxtBorlandDelphiBorlandC

Hunt Hypothesis

This detection identifies executable files compiled with Borland Delphi or C++ compilers using a specific YARA signature to uncover legacy or custom applications that may lack modern security controls. Proactively hunting for these artifacts in Azure Sentinel is essential to assess their risk posture and ensure they are not being leveraged by adversaries as trusted vectors for lateral movement or persistent access within the environment.

YARA Rule

rule FSGv120EngdulekxtBorlandDelphiBorlandC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 [2] 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the FSGv120EngdulekxtBorlandDelphiBorlandC detection rule, which identifies binaries compiled with Borland Delphi or C++ Builder. These scenarios reflect common legitimate enterprise activities that match the YARA signature.

• Legacy ERP Client Updates via Group Policy

  • Scenario: The enterprise utilizes a legacy Enterprise Resource Planning (ERP) system where client updates are distributed nightly via Microsoft System Center Configuration Manager (SCCM). The update package contains several .exe and .dll files compiled using Borland Delphi to maintain backward compatibility with older Windows versions. When the SCCM agent executes these binaries on endpoints, they trigger the rule due to their specific compiler signature.
  • Filter/Exclusion: Create a file hash exclusion for the known update installer (e.g., ERPClientUpdate.exe) located in the distribution point path (\\SCCM-SERVER\SoftwareUpdates\ERP\). Alternatively, exclude the process name if it is consistently launched by the SCCM service account (NT SERVICE\CcmExec).

• Scheduled Data Migration Tool Execution

  • Scenario: A dedicated scheduled job runs every Sunday at 02:00 AM to migrate financial data from an on-premise SQL database to a cloud warehouse. The migration utility, FinDataSync.exe, was developed in-house using Borland C++ Builder. When the Windows Task Scheduler (TaskScheduler) launches this tool under the domain service account (DOMAIN\svc_data_migration), the YARA rule flags it as a potential unknown Delphi/C binary execution.
  • Filter/Exclusion: Implement an exclusion based on the command line and parent process. Exclude any instance where ProcessName equals FinDataSync.exe, ParentImage is C:\Windows\System32\svchost.exe (or specifically