FSGv110EngdulekxtBorlandDelphi20

Hunt Hypothesis

This rule identifies executable files compiled with Borland Delphi, a legacy development framework frequently leveraged by threat actors to create custom malware or obfuscated payloads that may evade standard signature-based detection. Proactively hunting for these binaries in Azure Sentinel allows the SOC team to surface low-severity artifacts that could indicate early-stage reconnaissance or the deployment of niche tooling before they escalate into more complex attack chains.

YARA Rule

rule FSGv110EngdulekxtBorlandDelphi20
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Maintenance and Patching: Enterprise environments often retain legacy line-of-business applications (e.g., inventory management, legacy ERP modules) compiled with older versions of Borland Delphi. When IT staff or automated patching scripts (such as those using WSUS or SCCM) execute these .exe files to apply hotfixes or update configuration files, the binary’s Delphi signature may trigger the rule.

  • Suggested Filter: Exclude processes where the parent process is a known deployment agent (e.g., ccmexec.exe, wuaexhost.exe) or where the file path resides in specific legacy application directories (e.g., C:\Program Files\LegacyApp\bin\).

• Automated Scheduled Backup and Archival Jobs: Scheduled tasks (via Task Scheduler or cron on Linux hosts running Windows services) that archive or compress legacy application binaries into .zip or .tar.gz files may cause the YARA scanner to inspect the raw executable content. If the backup job runs as a service account (e.g., BackupSvc) and the target file is a known Delphi-compiled utility, this can generate a false positive.

  • Suggested Filter: Exclude events where the process name is tar.exe, 7z.exe, or zip.exe and the parent process is a scheduled task host (svchost.exe with specific service names) or a backup agent (e.g., VeeamBackup.exe, CommCell.exe).

• Development and Testing Environments: In development or QA zones, engineers frequently run Delphi-compiled test harnesses, unit test runners, or demo applications during build pipelines (e.g., Jenkins, Azure DevOps, or GitHub Actions). These binaries are intentionally built with Delphi and executed repeatedly in CI/CD agents, leading to consistent detections that