YARA rule for detecting orphaned VBA projects in DWG files
SANS ISC feed item, dated 2026-10-18, presenting a YARA rule for identifying orphaned VBA projects inside DWG files, the drawing format used in CAD. The source says the author used the rule, but the text received does not reproduce the rule itself.
What the source says: the SANS ISC feed published, on 2026-10-18, an item titled Orphaned VBA Projects Inside DWG Files. The author presents a YARA rule for detecting orphaned VBA projects in DWG files, meaning VBA macro blocks stored inside AutoCAD drawings that are not tied to a visible object in the file. The available text is an automatic translation of the summary and does not include the rule, indicators of compromise, threat family names or test results.
Why it matters: drawing files received from suppliers, clients or email may carry macro code. A detection rule based on file structure helps incident responders and malware analysts triage samples before opening them. The relevance to Rota Nacional is indirect: the platform does not scan DWG files or perform antimalware analysis, and should not be presented as a solution to that problem.
How to consult and verify: open the original on the SANS ISC official site, find the diary by title and date, and check the full rule, the required YARA version and the test conditions. Before applying any rule, run it against a known sample and clean files to measure false positives.