Turbo Pascal v20 1984 additional

Hunt Hypothesis

This hypothesis targets the presence of legacy Turbo Pascal v20 (1984) binaries or artifacts, which may indicate the use of outdated, unpatched development tools or custom scripts that could be leveraged for stealthy payload execution or obfuscation. Proactively hunting for these specific legacy signatures in Azure Sentinel helps identify potential supply chain risks or dormant backdoors that standard modern detection engines might miss due to their low severity and age.

YARA Rule

rule Turbo_Pascal_v20_1984_additional: PEiD
{
    strings:
        $a = { 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 34 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy DOS/Windows 3.11 Development Environment in Virtualization

  • Scenario: A developer or QA engineer maintains a dedicated virtual machine (e.g., VMware Workstation or Hyper-V) running Windows 3.11 or MS-DOS 6.22 to compile or debug legacy codebases written in Turbo Pascal v2.0 (1984). The TP.EXE or TPW.EXE binary resides in the user profile or a shared network drive mapped to the VM, triggering the YARA signature during a full-disk scan or real-time monitoring.
  • Filter/Exclusion: Exclude files located in specific virtualization guest paths (e.g., C:\VMs\LegacyDOS\, C:\Users\[User]\Virtual Machines\) or exclude the process TP.EXE if its parent process is a known virtualization agent (e.g., vmtoolsd.exe, vmsysmgt.exe) or if the file path contains \TURBO\ or \TP\.

• Archival Software Repository or Source Code Control

  • Scenario: An enterprise uses a source code management system (e.g., Git, Perforce, or SVN) or a file-based archive (e.g., a shared \\fileserver\legacy-code\ share) that stores historical versions of applications. The Turbo Pascal v2.0 compiler or its associated .TPU (Turbo Pascal Unit) files are checked in as part of the build artifacts or documentation, causing the YARA rule to match the static binary or unit files during periodic integrity scans.
  • Filter/Exclusion: Exclude files with extensions .TPU, .TP, or .EXE located in directories explicitly named legacy, archive, historical, or vcs (Version Control System) paths. Additionally