Borland Cpp 1992 1994 Hint DOS EP

Hunt Hypothesis

This hypothesis targets the presence of legacy Borland C++ binaries from 1992-1994 that exhibit DOS entry point characteristics, which often indicate the use of outdated, unpatched, or custom-compiled executables that may harbor hidden payloads or serve as initial access vectors. Proactively hunting for these specific artifacts in Azure Sentinel helps identify potential low-severity anomalies or dormant backdoors that standard signature-based detections might miss due to their age and obfuscation.

YARA Rule

rule Borland_Cpp_1992_1994_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 8C C8 8E D8 8C 1E ?? ?? 8C 06 ?? ?? 8C 06 ?? ?? 8C 06 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Financial Reporting Tool Execution: A finance department runs a custom-built, 16-bit DOS-based reporting utility (e.g., FINREP.EXE) compiled in the early 1990s to process year-end tax calculations. This binary is stored in a shared network drive and executed via a scheduled task on a legacy Windows 7 workstation.

  • Filter/Exclusion: Exclude files located in specific legacy application directories (e.g., \\fileserver\finance\legacy_apps\) or exclude processes where the parent process is schtasks.exe or taskeng.exe and the file path matches known legacy finance tool directories.

• Embedded Firmware Update Utility: An IT operations team uses a small, standalone DOS executable (FWUPD.EXE) to push firmware updates to industrial control system (ICS) gateways via a serial-to-USB adapter. The tool is copied to a temporary folder on the admin workstation for execution.

  • Filter/Exclusion: Exclude files with names matching common firmware update patterns (e.g., *UPD.EXE, *FLASH.EXE) located in temporary directories (%TEMP%, C:\Temp) or exclude if the process is spawned by a known serial communication tool (e.g., putty.exe, hyperterm.exe).

• Legacy Backup Verification Script: A system administrator runs a deprecated, Borland C++ compiled verification script (VERIFY.EXE) to validate checksums of backup tapes before archiving. The script is stored in a dedicated admin tools folder and executed manually.

  • Filter/Exclusion: Exclude files located in specific admin tools directories (e.g., C:\AdminTools\, C:\Scripts\Legacy\) or exclude if the user account belongs to a specific “Legacy Admins” security group.

• Older Version Control Client: A development team still