This detection identifies the presence of Borland development tools or legacy applications within the environment to uncover potential supply chain risks or outdated software configurations that may lack modern security controls. Proactively hunting for these assets in Azure Sentinel allows the SOC team to assess their exposure to known vulnerabilities and ensure they are properly monitored before adversaries can exploit them as an entry point.
rule Borland
{
meta:
author="malware-lu"
strings:
$patternBorland = "Borland" wide ascii
condition:
$patternBorland
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Here are 4 specific false positive scenarios for the Borland detection rule in a legitimate enterprise environment, along with suggested filters or exclusions:
Legacy ERP Reporting Engine Execution
ReportGen.exe) loads specific Borland runtime DLLs during its scheduled run at 02:00 AM.C:\Program Files\LegacyERP\Bin\ReportGen.exe and whitelist the associated hash of the main executable to prevent alerts on known legitimate report generation jobs.Database Backup Utility (Borland Database Engine)
BackupAgent.exe or DBArchive.exe when they are spawned by the parent process TaskScheduler (PID 104) during the defined maintenance window (Sunday 02:30–05:00).Custom Inventory Management Client