PseudoSigner02BorlandCDLLMethod2Anorganix

Hunt Hypothesis

This hypothesis targets the execution of malicious binaries that utilize the Borland CDLL method to spoof digital signatures, a technique often employed by threat actors to bypass security controls and establish persistence. Proactively hunting for this behavior in Azure Sentinel allows the SOC to identify low-severity, stealthy implantations that may otherwise go unnoticed until they escalate to more impactful post-exploitation activities.

YARA Rule

rule PseudoSigner02BorlandCDLLMethod2Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy Borland Delphi or C++ Builder application (e.g., an internal inventory management tool or legacy ERP client) is updated or recompiled by a developer using an older version of the Borland compiler. The resulting binary retains the specific CDLL (Call Dynamic Link Library) method signature and Borland-specific metadata that the rule targets, even though the code is signed by the internal corporate CA.

  • Filter/Exclusion: Exclude binaries where the FileDescription or ProductName contains “Borland”, “Delphi”, or “C++ Builder” AND the DigitalSignature issuer is the internal corporate CA (e.g., CN=CorpCodeSignRootCA). Alternatively, whitelist specific file paths under C:\Program Files\LegacyApps\ if the application is known to be stable.

• Scenario: An IT administrator manually copies a signed Borland-based utility (such as a custom regedit wrapper or a legacy driver installer) from a shared network drive (\\fileserver\tools\) to a local workstation for ad-hoc troubleshooting. The file is not re-signed locally, and its hash matches the known “pseudo-signer” pattern due to the original Borland compilation method, triggering the rule on the endpoint.

  • Filter/Exclusion: Exclude events where the Image path starts with C:\Windows\Temp\ or C:\Users\<User>\Downloads\ AND the ParentImage is a known admin tool like explorer.exe or cmd.exe. Additionally, exclude if the file’s SHA256 is present in the internal “Known Good Binaries” database.

• Scenario: A scheduled task runs a legacy Borland-based reporting script (e.g., ReportGen.exe) that was originally developed in 2005 and has not been recompiled. The script is