Borland Delphi 2.0 - 7.0 / 2005 - 2007

Hunt Hypothesis

This rule identifies the presence of legacy Borland Delphi applications, which may indicate the use of outdated or unpatched software that could be leveraged by adversaries for initial access or persistence. Proactively hunting for these instances allows the SOC team to identify potential attack surfaces and prioritize remediation or virtual patching for critical systems running these older versions.

YARA Rule

rule borland_delphi {
	meta:
		author = "_pusher_"
		description = "Borland Delphi 2.0 - 7.0 / 2005 - 2007"
		date = "2016-03"
		version = "0.2"
	strings:
		$c0 = { 53 8B D8 33 C0 A3 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? FF A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 33 C0 A3 }
		$c1 = { 53 8B D8 33 C0 A3 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 8D 43 08 A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 5B C3 }
		//some x64 version of delphi
		$c2 = { 53 48 83 EC 20 48 89 CB C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 48 33 C9 E8 ?? ?? ?? ?? 48 89 05 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 89 05 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 43 10 48 89 05 ?? ?? ?? ?? 48 8D 05 ?? FC FF FF 48 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 D9 48 8D 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 83 C4 20 5B C3 }
		//unusual delphi version unknown version (unpackme- FSG 1.31 - dulek)
		$c3 = { 50 6A 00 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 00 00 00 00 C7 42 0C 00 00 00 00 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 }
		//delphi2
		$c4 = { E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0A ?? ?? ?? B8 ?? ?? ?? ?? C3 }
		//delphi3
		$c5 = { 50 6A 00 E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 55 8B EC 33 C0 }
		//delphi5
		$c6 = { 50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 ?? ?? ?? ?? C7 42 0C ?? ?? ?? ?? E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 }
	condition:
		any of them
		and
		(
		//if its not linker 2.25 its been modified (unpacked usually)
												//unknown x64 build of delphi
		((pe.linker_version.major == 2) and (pe.linker_version.minor == 25 )) or ((pe.linker_version.major == 8) and (pe.linker_version.minor == 0 ))
		//unpacked files usually have this linker:
		or ((pe.linker_version.major == 0) and (pe.linker_version.minor == 0 )) )
		//could check for dvclal.. maybe too much
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy ERP Reporting Module Execution: The organization runs a custom-built inventory reporting tool developed in Delphi 7.0 in 2004, which is executed via a scheduled task (C:\Program Files\LegacyERP\ReportGen.exe) every Monday at 02:00 AM by the svc-erp-report service account.
  • Filter/Exclusion: Exclude processes where the parent process is schtasks.exe or taskeng.exe AND the file path contains C:\Program Files\LegacyERP\ AND the user is svc-erp-report.
• Internal HR Time-Tracking Application: A standalone desktop application for employee time tracking, built with Delphi 2005, is installed on all HR staff workstations at C:\Users\Public\Documents\HRTools\TimeTrack.exe and is launched manually by HR managers during weekly payroll preparation.
  • Filter/Exclusion: Exclude processes where the file path matches C:\Users\Public\Documents\HRTools\TimeTrack.exe AND the user group is HR-Staff AND the process name is TimeTrack.exe.
• Legacy Point-of-Sale (POS) Terminal Service: The retail division uses a legacy POS system written in Delphi 6.0, running as a background service (POS_Service.exe) on dedicated terminal servers (SRV-POS-01 to SRV-POS-05) that handles transaction logging and receipt printing.
  • Filter/Exclusion: Exclude processes where the computer name matches SRV-POS-* AND the process name is POS_Service.exe AND the user is svc-pos-service.
• Database Maintenance Utility: A custom database cleanup script written in Delphi 2007 (DBClean.exe) is executed by the DBA team via a shared