PseudoSigner01BorlandDelphi50KOLMCKAnorganix

Hunt Hypothesis

This rule identifies executable files compiled with Borland Delphi 5.0 that exhibit specific YARA patterns, often associated with legacy or obfuscated malware used to evade signature-based detection. Proactively hunting for these artifacts in Azure Sentinel helps identify potentially compromised workloads or staging environments where adversaries may be leveraging outdated toolchains to establish a foothold or prepare for lateral movement.

YARA Rule

rule PseudoSigner01BorlandDelphi50KOLMCKAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 90 90 90 90 68 [4] 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Borland Delphi 5.0 Application Deployment: When IT operations deploy or update legacy line-of-business applications built with Borland Delphi 5.0 (e.g., inventory management or point-of-sale systems) via Group Policy or SCCM, the executable files often retain the original compiler signature and lack modern code signing, triggering the “BorlandDelphi50” heuristic.
  • Filter/Exclusion: Exclude file paths under specific legacy application directories (e.g., C:\Program Files\LegacyPOS\ or C:\Apps\Inventory5\) or exclude executables with a specific version string matching the known legacy build (e.g., 5.0.0.*) if the application is whitelisted in the software inventory.
• Third-Party Borland Delphi 5.0 Plugin or DLL: Enterprise software (such as older ERP modules or industrial control system interfaces) may load third-party DLLs or helper executables compiled with Borland Delphi 5.0. These components are often unsigned or signed with an expired certificate, causing the YARA rule to match during process creation or file load events.
  • Filter/Exclusion: Exclude specific DLL filenames associated with known legacy vendors (e.g., legacy_plugin.dll, borland_helper.exe) or exclude files located in vendor-specific plugin directories (e.g., C:\Program Files\VendorX\Plugins\) that are verified in the application allowlist.
• Scheduled Backup or Maintenance Job for Legacy Systems: A scheduled task (e.g., LegacyDBBackup) runs a small utility script or executable written in Borland Delphi 5.0 to extract or compress data from legacy databases. The utility is often a standalone, unsigned binary placed in a service account’s home directory or a shared maintenance folder.
  • Filter/Exclusion: Exclude the specific executable