Borland Component

Hunt Hypothesis

This rule detects the presence of Borland Component objects, which are frequently leveraged by adversaries for persistence or code execution via legacy COM automation within Windows environments. Proactively hunting for these components in Azure Sentinel allows the SOC team to identify potential low-severity footholds or dormant backdoors that may be used to maintain access or facilitate further lateral movement before they are fully exploited.

YARA Rule

rule borland_component {
	meta:
		author = "_pusher_"
		description = "Borland Component"
		date = "2015-08"
		version = "0.1"
	strings:
		$c0 = { E9 ?? ?? ?? FF 8D 40 00 }
	condition:
		$c0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Delphi/C++Builder Application Deployment: When IT operations deploy or update legacy desktop applications built with Borland Delphi or C++Builder (common in manufacturing, finance, and healthcare sectors), the installer or the application binary itself may contain Borland-specific version strings, debug symbols, or component names (e.g., TForm, TButton, Borland.VCL) that trigger the rule.

  • Filter/Exclusion: Exclude processes or file paths associated with known legacy application installers (e.g., msiexec.exe executing packages from C:\Program Files\LegacyApp\ or specific vendor directories like C:\Program Files (x86)\Borland\). Additionally, whitelist specific executable names known to be Borland-based (e.g., MyLegacyApp.exe) if they are consistently benign.

• Development Environment Build Tasks: Developers using Borland/Embarcadero IDEs (such as Delphi, C++Builder, or Turbo Pascal) often trigger this rule during compilation, debugging, or package installation. The IDE’s compiler (dcc32.exe, bcc32.exe) or the bpl/dcp file handling may generate events matching the “Borland Component” signature.

  • Filter/Exclusion: Exclude processes originating from known development directories (e.g., C:\Program Files (x86)\Embarcadero\, C:\Program Files (x86)\Borland\) or specific compiler executables (dcc32.exe, bcc32.exe, tcc.exe). Consider excluding user groups with the “Developers” AD group if the rule is process-based.

• Scheduled Maintenance of Borland-Based Middleware: Some enterprise middleware or legacy ESB (Enterprise Service Bus) components, or custom-built services, may be written in Borland languages