PseudoSigner 01 Borland Delphi 50 KOLMCK Anorganix

Hunt Hypothesis

This rule identifies executable files compiled with Borland Delphi 5.0 that exhibit specific structural markers associated with the PseudoSigner tool, a technique often used by adversaries to create fake digital signatures to bypass security controls. Proactively hunting for these artifacts in Azure Sentinel helps detect potentially malicious or unsigned binaries that may be leveraging outdated compiler signatures to evade detection and establish a foothold within the environment.

YARA Rule

rule _PseudoSigner_01_Borland_Delphi_50_KOLMCK_Anorganix: PEiD
{
    strings:
        $a = { 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Intranet Application Deployment: A custom internal HR or inventory management tool built in Borland Delphi 5.0 is distributed via Group Policy or a deployment script (e.g., SCCM) to user endpoints. The executable is signed with a self-signed or outdated certificate that matches the “Anorganix” pseudo-signature pattern due to the specific compiler version and resource strings.
  • Filter/Exclusion: Exclude files located in standard application directories (e.g., C:\Program Files\InternalApps\HRSystem\) or exclude based on the specific file hash if the binary is static. Additionally, consider whitelisting the parent process if the executable is launched by a known service host like svchost.exe or a specific app launcher.
• Older Third-Party Utility Execution: An IT administrator runs a legacy utility (e.g., a disk defragmenter or registry cleaner from the 2000s) that was compiled with Delphi 5.0. The tool is executed from a temporary directory or a shared network drive during a maintenance window.
  • Filter/Exclusion: Exclude execution if the parent process is a known administrative tool (e.g., cmd.exe, powershell.exe, wmic.exe) and the file path contains keywords like temp, tools, or utilities. Alternatively, exclude if the file’s digital signature issuer matches a known legacy vendor list.
• Scheduled Maintenance Job: A scheduled task (Task Scheduler) runs a small Delphi-based script or helper executable to clean up logs or rotate backups. The executable is stored in a service directory and is signed with a pseudo-signature that triggers the YARA rule due to the specific “KOLMCK” resource marker.
  • Filter/Exclusion: Exclude if the executable is launched by schtasks.exe or TaskScheduler and resides