SANS publishes YARA rule to detect hidden VBA malware in AutoCAD DWG files
SANS Internet Storm Center released a YARA rule for detecting orphaned VBA projects embedded in DWG files, a technique used to hide malicious code in CAD drawings.
Summary
The SANS Internet Storm Center has published a YARA rule designed to detect orphaned VBA projects inside DWG files. Attackers can embed malicious Visual Basic for Applications code within AutoCAD drawing files, leaving no visible macro indicators in the standard interface. The detection rule helps security teams identify such hidden payloads in enterprise environments where CAD files are routinely exchanged.
How the detection works
- The YARA rule targets the specific structure of orphaned VBA projects within DWG binary format
- Orphaned VBA projects lack normal document references, making them invisible to standard AutoCAD macro warnings
- DWG files are widely shared in engineering, architecture, and manufacturing supply chains
- The rule enables automated scanning without requiring AutoCAD software installation
Why it matters
CAD files receive less security scrutiny than Office documents, making this vector particularly dangerous for industrial and engineering organizations that rely heavily on DWG exchange with external partners.
Original reference: isc.sans.edu →