Borland C++

Hunt Hypothesis

This rule identifies the presence of Borland C++ binaries, which are often associated with legacy or embedded systems and can serve as a vector for supply chain attacks or persistent backdoors in enterprise environments. Proactively hunting for these artifacts allows the SOC team to uncover unexpected or unauthorized code execution that may have been introduced through compromised dependencies or outdated software, reducing the risk of stealthy adversary persistence.

YARA Rule

rule borland_cpp {
	meta:
		author = "_pusher_"
		description = "Borland C++"
		date = "2015-08"
		version = "0.1"
	strings:
		$c0 = { 59 5F 6A 00 E8 ?? ?? ?? ?? 59 68 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 6A 00 E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 C0 A0 ?? ?? ?? ?? C3 A1 ?? ?? ?? ?? C3 }
		$c1 = { A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 52 6A 00 E8 ?? ?? ?? ?? 8B D0 E8 ?? ?? ?? ?? 5A E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? 59 68 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 6A 00 E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 C0 A0 ?? ?? ?? ?? C3 A1 ?? ?? ?? ?? C3 }
		$c2 = { 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 6A 00 E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 C0 A0 ?? ?? ?? ?? C3 A1 ?? ?? ?? ?? C3 }
	condition:
		(
		//linker 2.25 and 5.00
		((pe.linker_version.major == 2) and (pe.linker_version.minor == 25 )) or
		((pe.linker_version.major == 5) and (pe.linker_version.minor == 0 ))
		) and
		any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy: When IT administrators deploy or update legacy enterprise applications (e.g., older versions of SAP GUI, Oracle client components, or specific financial reporting tools) that were originally compiled with Borland C++ (Turbo C++), the executable files often retain the Borland C++ string in their version information or resource sections.

  • Filter/Exclusion: Exclude files located in standard application directories (e.g., C:\Program Files\, C:\Program Files (x86)\) that match known legacy vendor names (e.g., SAP, Oracle, Sybase) and have a file creation date older than 2 years.

• Database Driver Installation: Installing or updating ODBC/ODBC drivers or JDBC bridges for older database systems (such as Sybase, InterBase, or early versions of Firebird) often involves binaries compiled with Borland C++ toolchains. These drivers are typically installed in system directories during patch cycles or new server provisioning.

  • Filter/Exclusion: Exclude processes or files with names containing odbc, jdbc, driver, or specific database vendor keywords (e.g., sybase, interbase) located in C:\Windows\System32\ or C:\Program Files\ subdirectories.

• Backup and Restore Operations: During full system image restores or granular file restores using enterprise backup solutions (e.g., Veeam, Commvault, Veritas), legacy application binaries that originally contained Borland C++ signatures are written back to disk. The detection engine may flag these restored files as new or modified artifacts.

  • Filter/Exclusion: Exclude files that are currently being written by known backup agent processes (e.g., vss.exe, commvaultagent.exe, veritasbackup.exe) or files with a recent “restore