FSG v110 Eng dulekxt Borland Cpp 1999 additional

Hunt Hypothesis

This YARA rule identifies legacy Borland C++ 1999 binaries associated with the FSG v110 family, often used in low-severity fileless or memory-resident malware scenarios that evade standard signature-based detection. Proactively hunting for these specific compiler artifacts helps the SOC team uncover dormant or stealthy threats that may be leveraging outdated development tools to blend in with legitimate legacy applications within the Azure Sentinel environment.

YARA Rule

rule FSG_v110_Eng_dulekxt_Borland_Cpp_1999_additional: PEiD
{
    strings:
        $a = { EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Delphi/C++ Builder Application Deployment: In many enterprise environments, older line-of-business (LOB) applications built with Borland C++ Builder 5.0 (1999) are still in use. When IT operations deploy updates or patches to these legacy apps via Group Policy or SCCM, the binary files on disk may match the YARA signature.

  • Filter/Exclusion: Exclude files located in specific legacy application directories (e.g., C:\Program Files\LegacyERP\bin\ or C:\Apps\FinanceSuite\) or exclude executables with a specific version string in the PE header that matches the known legacy build (e.g., FileVersion=5.0.0.0 and ProductVersion=5.0).

• Antivirus/EDR Quarantine Scanning: Security tools like Microsoft Defender for Endpoint or CrowdStrike Falcon continuously scan files in the quarantine folder or temporary directories. If a previously quarantined or temporarily extracted file from a legacy installer or update package matches the Borland C++ 1999 signature, it can trigger the rule during the scan process.

  • Filter/Exclusion: Exclude files located in standard quarantine or temporary paths such as C:\ProgramData\Microsoft\Windows Defender\Quarantine\ or C:\Windows\Temp\ where the file owner is a known security service (e.g., MsMpEng.exe or CrowdStrike Falcon Sensor).

• Scheduled Backup or Archive Job: Enterprise backup solutions like Veeam, Commvault, or Windows Server Backup often create temporary copies or archives of application data. If a backup job processes a legacy application binary and writes a temporary copy to a staging area, the YARA rule may detect the file during the write or verification phase.

  • Filter/Exclusion: Exclude files created by known backup services (