FSGv120EngdulekxtBorlandDelphiMicrosoftVisualC

Hunt Hypothesis

This rule identifies executable files compiled with Borland Delphi or Microsoft Visual C++ that exhibit specific structural characteristics, potentially indicating the presence of custom or obfuscated malware binaries. Proactively hunting for these artifacts helps the SOC team uncover low-severity threats that may evade signature-based detection by leveraging common development frameworks to blend in with legitimate software.

YARA Rule

rule FSGv120EngdulekxtBorlandDelphiMicrosoftVisualC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 [2] 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy: An enterprise IT team deploys a legacy line-of-business application compiled with Borland Delphi or early Microsoft Visual C++ (pre-.NET) to a fleet of Windows 10/11 endpoints using Group Policy Software Installation. The YARA rule matches the binary signature of the installer or the application executable itself, triggering alerts on every machine where the GPO is applied.

  • Filter/Exclusion: Exclude files located in standard program directories (e.g., C:\Program Files\, C:\Program Files (x86)\) that are signed by known corporate vendors or match specific hash lists of approved legacy applications. Alternatively, exclude processes initiated by gpupdate.exe or gpedit services during the initial deployment window.

• Third-Party Management Agent Installation: A security or endpoint management vendor (e.g., CrowdStrike, SentinelOne, or a niche ITAM tool) installs an agent that contains a native C/C++ component or a Delphi-based helper utility for low-level system access. The agent’s core binary or its updater service matches the YARA pattern due to its compiler signature.

  • Filter/Exclusion: Create a whitelist for known vendor paths (e.g., C:\ProgramData\CrowdStrike\, C:\Program Files\SentinelOne\) and exclude processes where the parent process is a known service host (svchost.exe with specific service names) or the vendor’s installer executable (e.g., setup.exe, install.exe) from the vendor’s official directory.

• Scheduled Maintenance Job for Database Tools: A DBA team runs a scheduled task (Task Scheduler) to execute a native utility (e.g., a backup verification script or a log rotation tool) written in Borland Delphi or C++ for performance reasons. The task runs under the SYSTEM or a dedicated