PseudoSigner 01 Borland Delphi 60 70

Hunt Hypothesis

This rule identifies executable files compiled with Borland Delphi 6.0 or 7.0 that exhibit characteristics associated with the PseudoSigner tool, a technique often used by adversaries to create unsigned or falsely signed binaries to evade security controls. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to detect potential low-severity malware or trojans that leverage legacy compiler signatures to blend in with legitimate software, reducing the risk of undetected persistence or initial access.

YARA Rule

rule _PseudoSigner_01_Borland_Delphi_60_70: PEiD
{
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Intranet Application Deployment: An IT administrator deploys an internal inventory management tool built with Borland Delphi 6.0 to a specific server group using SCCM or Intune. The executable is not digitally signed by a modern CA but is trusted due to its internal origin.
  • Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Program Files\InternalTools\Inventory\) or exclude processes where the parent is ccmexec.exe or IntuneAgent.exe and the file path matches known legacy app folders.
• Third-Party Legacy Plugin for Browser or IDE: A developer installs a legacy plugin for an older version of Visual Studio or a specific browser extension that was compiled with Delphi 7.0. The plugin resides in the user’s profile or a shared development tools directory.
  • Filter/Exclusion: Exclude files under C:\Users\*\AppData\Local\ or C:\Program Files (x86)\ if the parent process is a known IDE (e.g., devenv.exe, code.exe) or browser process (chrome.exe, firefox.exe), and the file name contains keywords like plugin, extension, or addon.
• Scheduled Maintenance Job for Legacy Reporting Tool: A nightly scheduled task runs a custom reporting script written in Delphi 6.0 to generate PDF reports from a legacy database. The executable is stored in a dedicated C:\Scripts\ or C:\Maintenance\ folder.
  • Filter/Exclusion: Exclude files where the parent process is svchost.exe (specifically the Task Scheduler service) or taskschd.msc, and the file path matches C:\Scripts\ or C:\Maintenance\ with a file extension of .exe.
• **Test