Free Pascal v1010 win32 console

Hunt Hypothesis

This hypothesis targets the presence of Free Pascal v10.10 Win32 console binaries, which adversaries may leverage to execute custom scripts or tools in a low-noise manner on Windows endpoints. Proactively hunting for this specific version helps identify potential staging or execution artifacts that standard generic compiler detections might miss, ensuring visibility into niche tooling used for post-compromise activities.

YARA Rule

rule Free_Pascal_v1010_win32_console: PEiD
{
    strings:
        $a = { C6 05 ?? ?? ?? 00 01 E8 ?? ?? 00 00 C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 ?? EC }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Build Automation on CI/CD Agents: Developers may use Free Pascal 10.10 to compile specific legacy utility scripts or internal tools on Windows-based CI/CD build agents (e.g., Azure DevOps agents or Jenkins nodes) that retain older toolchains for backward compatibility.
  • Filter/Exclusion: Exclude processes where the parent process is a known build agent service (e.g., vstsagent.exe, jenkins.exe) or where the executable path resides within a designated CI/CD workspace directory (e.g., C:\agent\_work\).
• Scheduled Data Conversion Jobs: IT operations teams might schedule a nightly job using schtasks or a service to convert legacy data files (e.g., .csv to .xml) using a custom Free Pascal console application stored in a shared network drive or local system directory.
  • Filter/Exclusion: Exclude if the process is spawned by schtasks.exe or svchost.exe (Service Control Manager) and the executable path is located in a standard system or application data directory (e.g., C:\Program Files\InternalTools\ or C:\Windows\System32\).
• Internal Utility Deployment via Group Policy: Administrators may deploy a small Free Pascal-based utility (e.g., a disk cleanup script or log rotator) to endpoints via Group Policy Software Distribution, placing the binary in a standard system location.
  • Filter/Exclusion: Exclude if the executable path matches common GPO deployment locations such as C:\Windows\Temp\, C:\ProgramData\, or C:\Users\Default\ and the parent process is gpupdate.exe or svchost.exe.
• Developer Local Testing on Workstations: Senior developers or QA engineers may run the Free Pascal compiler or a compiled console app locally on their work