BeRoTinyPascalBeRo

Hunt Hypothesis

This rule identifies the presence of BeRo Tiny Pascal, a lightweight scripting engine often embedded in malware to execute logic and facilitate communication. Proactively hunting for this component in Azure Sentinel allows the SOC to detect early-stage infection or persistence mechanisms that may not yet trigger high-severity alerts, enabling faster containment of low-fidelity threats.

YARA Rule

rule BeRoTinyPascalBeRo
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 [4] 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of TinyPascal.exe (or similar Pascal-based utility) by a DevOps team for lightweight script compilation or binary patching during a CI/CD pipeline.
  • Filter/Exclusion: Exclude processes where the parent process is pwsh.exe, python.exe, or node.exe and the file path resides under C:\build\ or C:\ci\.
• Scenario: A scheduled maintenance job runs a Pascal-based log rotation or cleanup utility (e.g., LogCleanerPascal.exe) from a shared network drive or a specific admin tools directory.
  • Filter/Exclusion: Exclude if the executable path matches \\fileserver\tools\ or C:\AdminTools\ and the process name ends in .exe with a known hash or specific naming convention like *Pascal*.exe.
• Scenario: An IT support technician uses a portable Pascal-based diagnostic tool (e.g., SysInfoPascal.exe) copied to C:\Users\<admin>\Downloads\ to troubleshoot a user’s machine.
  • Filter/Exclusion: Exclude if the user account belongs to the IT_Support or Admins group and the file path contains Downloads or Temp, provided the process lifetime is less than 10 minutes.
• Scenario: A legacy application installer (written in Pascal/Delphi) runs a helper executable during a standard software deployment via SCCM or Intune.
  • Filter/Exclusion: Exclude if the parent process is ccmexec.exe (SCCM) or IntuneAgent.exe and the executable name matches *Setup* or *Install* with a Pascal-related suffix.
• Scenario: A developer locally tests a new Pascal-based microservice component by running the