Borland Delphi DLL

Hunt Hypothesis

This rule identifies the presence of Borland Delphi DLLs, which are frequently leveraged by adversaries for living-off-the-land techniques or to execute custom malware components. Proactively hunting for these artifacts helps the SOC team detect potential supply chain compromises or low-and-slow intrusions that may not trigger immediate high-severity alerts.

YARA Rule

rule borland_delphi_dll {
	meta:
		author = "_pusher_"
		description = "Borland Delphi DLL"
		date = "2015-08"
		version = "0.1"
		info = "one is at entrypoint"
	strings:
		$c0 = { BA ?? ?? ?? ?? 83 7D 0C 01 75 ?? 50 52 C6 05 ?? ?? ?? ?? ?? 8B 4D 08 89 0D ?? ?? ?? ?? 89 4A 04 }
		$c1 = { 55 8B EC 83 C4 ?? B8 ?? ?? ?? ?? E8 ?? ?? FF FF E8 ?? ?? FF FF 8D 40 00 }
	condition:
		any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy ERP/CRM Application Updates: Enterprise resource planning (ERP) or customer relationship management (CRM) systems (e.g., older versions of SAP, Oracle, or custom internal tools) often rely on Borland Delphi for their client-side GUIs or background services. When IT operations deploy a patch or update to these applications, the installer may drop or update .dll files with Delphi signatures.

  • Filter/Exclusion: Exclude files located in the specific application install directories (e.g., C:\Program Files\[LegacyApp]\bin\ or C:\Program Files (x86)\[LegacyApp]\) or exclude processes initiated by known installers (e.g., msiexec.exe, setup.exe) within those paths.

• Scheduled Database Maintenance Jobs: Database administrators often use Delphi-based utility scripts or small helper executables to perform nightly backups, log rotations, or data integrity checks. These jobs are typically triggered by Windows Task Scheduler or cron-like equivalents and may load Delphi DLLs during execution.

  • Filter/Exclusion: Exclude events where the parent process is svchost.exe (if running as a service) or TaskScheduler-related processes, and the file path matches known maintenance directories (e.g., C:\Scripts\DBMaintenance\ or C:\AdminTools\).

• Third-Party Monitoring Agents: Some legacy IT monitoring or endpoint management agents (e.g., older versions of Nagios plugins, custom Zabbix agents, or legacy SCCM components) are built using Delphi. During agent heartbeats, configuration reloads, or plugin updates, these agents may load Delphi DLLs.

  • Filter/Exclusion: Exclude files located in the monitoring agent’s installation directory (e.g., C:\Program Files\MonitoringAgent\plugins\ or `C:\Program Files (x