FreePascal 200 Win32 additional

Hunt Hypothesis

This rule detects the presence of FreePascal 200 Win32 binaries, which are often leveraged by threat actors for lightweight payload execution or as a component in multi-stage attacks due to their small footprint and common availability. Proactively hunting for these signatures allows the SOC to identify potential low-and-slow intrusions or staging activities that may have evaded traditional behavioral detections in the Azure Sentinel environment.

YARA Rule

rule FreePascal_200_Win32_additional: PEiD
{
    strings:
        $a = { C6 05 ?? ?? ?? ?? 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are specific false positive scenarios for the FreePascal 200 Win32 additional YARA rule, along with suggested filters:

• Legacy Internal Tooling Compilation: Developers or DevOps engineers may compile small utility scripts or internal automation tools using FreePascal 200 (an older, stable release) on build servers or developer workstations. These binaries often reside in C:\Users\<dev>\Projects\ or D:\Builds\ and are executed via cmd.exe or PowerShell.

  • Filter/Exclusion: Exclude processes where the parent process is cmd.exe, powershell.exe, or pwsh.exe AND the image path matches *\\Projects\\* or *\\Builds\\* AND the user is part of the DevOps or Engineering AD group.

• Scheduled Backup or Maintenance Scripts: IT operations teams may use FreePascal-compiled executables for niche maintenance tasks (e.g., disk cleanup, log rotation, or specific hardware checks) that are triggered by Windows Task Scheduler. These often run as SYSTEM or a dedicated service account and reside in C:\ProgramData\ or C:\Scripts\.

  • Filter/Exclusion: Exclude processes where the parent process is svchost.exe (specifically the Task Scheduler service) AND the image path contains *\\ProgramData\\* or *\\Scripts\\* AND the user is NT AUTHORITY\SYSTEM or a known maintenance account (e.g., svc-maintenance).

• Third-Party Application Dependencies: Some older or niche enterprise applications (e.g., specific POS systems, legacy ERP modules, or industrial control software) may bundle FreePascal-compiled helper executables in their installation directories. These are typically located in `C