# SANS releases YARA rule to detect orphaned VBA projects in AutoCAD DWG files

> **Key takeaway:** The SANS Internet Storm Center published a YARA rule for detecting malicious orphaned VBA projects embedded in DWG files.

**Published:** 2026-10-18T12:59:30+00:00 
**Source:** SANS Internet Storm Center 
**Category:** cybersecurity 
**Canonical URL:** https://fosswire.org/news/sans-releases-yara-rule-to-detect-orphaned-vba-projects-in-a.html 

## Summary
SANS Internet Storm Center has shared a YARA rule designed to identify 'orphaned' VBA projects inside DWG files. These orphaned projects can be used as a vector for malware delivery through AutoCAD drawing files. The rule provides a detection mechanism for security teams monitoring file-based threats in engineering and design environments.

## How the YARA rule works
- The rule targets VBA projects that remain in DWG files without proper document linkage
- Detection focuses on the specific structure of orphaned VBA project streams within the DWG container format
- Useful for automated scanning of AutoCAD files in enterprise environments
- Can be integrated into existing YARA-based security scanning pipelines

## Why it matters
Engineering firms and organizations using AutoCAD in mixed environments gain a practical open detection tool for a file format that is frequently exchanged externally and often bypasses standard email security filters.