SANS releases YARA rule to detect orphaned VBA projects in AutoCAD DWG files
Key Takeaway
The SANS Internet Storm Center published a YARA rule for detecting malicious orphaned VBA projects embedded in DWG files.
Summary
SANS Internet Storm Center has shared a YARA rule designed to identify 'orphaned' VBA projects inside DWG files. These orphaned projects can be used as a vector for malware delivery through AutoCAD drawing files. The rule provides a detection mechanism for security teams monitoring file-based threats in engineering and design environments.
How the YARA rule works
- The rule targets VBA projects that remain in DWG files without proper document linkage
- Detection focuses on the specific structure of orphaned VBA project streams within the DWG container format
- Useful for automated scanning of AutoCAD files in enterprise environments
- Can be integrated into existing YARA-based security scanning pipelines
Why it matters
Engineering firms and organizations using AutoCAD in mixed environments gain a practical open detection tool for a file format that is frequently exchanged externally and often bypasses standard email security filters.
Original reference: isc.sans.edu →