CyberNew CyberNew
Cyber News Isc 59 minutes ago

Orphaned VBA Projects Inside DWG Files: YARA Rule, (Sun, Oct 18th)

CN
CyberNew Threat Research Desk
• Original Reporting: Isc
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Cyber News

Analyst Takeaway

"Here is the YARA rule I used to detect " Orphaned VBA Projects Inside DWG Files ". rule autocad_orphaned_vba_project { strings : $a = "AC10" $b = { D0 CF 11 E0 A1 B1 1A E1 } $c = "[Host Extender Info]" ascii condition : $a at 0 and uint32 ( 0x24 ) == 0 and $b and $c } A VirusTotal retrohunt with this rule gave me only 2 detections: 09d4607941e458f6dbb6be17825641d863c0b37c185027984e137d8a67e919d8"

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from Isc.

Primary Advisory →