PseudoSigner02BorlandDelphiSetupModuleAnorganix

Hunt Hypothesis

This rule identifies executable files containing Borland Delphi setup modules that exhibit characteristics of the PseudoSigner02 tool, a known method for forging digital signatures to bypass trust-on-first-use (TOFU) security controls. Proactively hunting for these artifacts in Azure Sentinel helps detect potentially malicious or trojanized applications that may have been deployed to endpoints, allowing the SOC to investigate suspicious binaries before they can establish persistence or execute further malicious actions.

YARA Rule

rule PseudoSigner02BorlandDelphiSetupModuleAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Borland Delphi Application Deployment: In environments still maintaining legacy desktop applications built with older versions of Borland Delphi (e.g., Delphi 7 or 2005), the setup.exe or installer modules often contain the specific byte patterns or string references targeted by this rule. These installers are frequently pushed via Group Policy Objects (GPO) or Configuration Manager (SCCM) during monthly patch cycles.

  • Filter/Exclusion: Exclude files located in standard software distribution paths (e.g., C:\Program Files\Delphi\, C:\SCCM\, or C:\GPO\) or specifically exclude executables named setup.exe that are signed by a known internal CA or match a specific hash list of legacy Delphi installers.

• Third-Party Software Bundlers and Installers: Many commercial off-the-shelf (COTS) applications, particularly older enterprise tools like specific versions of Adobe Creative Suite, Oracle Java, or legacy ERP clients, bundle Borland Delphi-based installer frameworks. These are commonly triggered when IT admins run silent installations via PowerShell scripts or scheduled tasks for new user onboarding.

  • Filter/Exclusion: Create an allowlist for known vendor directories (e.g., C:\Program Files\Adobe\, C:\Program Files\Java\, C:\Program Files\Oracle\) and exclude processes initiated by standard administrative accounts (e.g., DOMAIN\svc-itadmin) or parent processes like powershell.exe or cmd.exe running from C:\Windows\System32\.

• Development and Testing Environments: Developers using Borland Delphi or CodeGear Delphi IDEs will frequently compile and run test executables or debug builds on their workstations. These builds may not be fully signed or may retain the “Anorganix” module signature if using specific third-party