← Back to SOC feed Coverage →

Borland

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-31T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies the presence of Borland development tools or legacy applications within the environment to uncover potential supply chain risks or outdated software configurations that may lack modern security controls. Proactively hunting for these assets in Azure Sentinel allows the SOC team to assess their exposure to known vulnerabilities and ensure they are properly monitored before adversaries can exploit them as an entry point.

YARA Rule

rule Borland
{
      meta:
		author="malware-lu"
	strings:
		$patternBorland = "Borland" wide ascii
	condition:
		$patternBorland
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Here are 4 specific false positive scenarios for the Borland detection rule in a legitimate enterprise environment, along with suggested filters or exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/packers/packer.yar