Free Pascal

Hunt Hypothesis

This rule detects the execution of the Free Pascal compiler, which adversaries may leverage to compile custom malware or exploit code directly on the host to evade static analysis. Proactively hunting for this activity in Azure Sentinel allows the SOC team to identify potential build-and-run tactics that could indicate an attacker establishing a foothold or preparing for lateral movement.

YARA Rule

rule free_pascal {
	meta:
		author = "_pusher_"
		description = "Free Pascal"
		date = "2015-08"
		version = "0.1"
	strings:
		$c0 = { 55 89 E5 83 ?? ?? 89 5D FC B8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? A0 ?? ?? ?? ?? 84 C0 75 0C 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 }
		$c1 = { 55 89 E5 53 B8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 80 3D ?? ?? ?? ?? 00 75 0C 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? B8 }
		$c2 = { 55 89 E5 83 EC 04 89 5D FC B8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A0 ?? ?? ?? ?? 84 C0 75 05 E8 ?? ?? ?? ?? C7 05 }
	condition:
		any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer installs the fpc (Free Pascal Compiler) package via a package manager (e.g., apt-get install fpc or dnf install fpc) to compile legacy utility scripts or test code in a staging environment.
  • Filter/Exclusion: Exclude events where the parent process is a known package manager (e.g., apt, dnf, yum, zypper) or where the command line contains install or update and the user belongs to a developers or ops group.
• Scenario: An automated CI/CD pipeline job runs a build script that invokes the fpc compiler to generate executables for a specific microservice or internal tool, often triggered by a scheduled cron job or GitLab/GitHub Actions runner.
  • Filter/Exclusion: Exclude events where the parent process is a CI/CD agent (e.g., gitlab-runner, jenkins, drone, circleci) or where the working directory is within a known build artifact path (e.g., /opt/ci/builds/, /home/runner/work/).
• Scenario: A system administrator uses fpc to compile a small, standalone utility script (e.g., a log parser or network checker) on a jump host or bastion server for ad-hoc troubleshooting.
  • Filter/Exclusion: Exclude events where the user is a member of the sudo or admins group and the host is tagged as a bastion or jump-host in CMDB, or where the command line includes fpc followed by a .pas file located in a temporary or admin-specific directory (e.g., /tmp/, /root/scripts/).
• Scenario: A legacy application or custom internal tool