YARA Rule for Detecting Orphaned VBA Projects in DWG Files
On 18 October 2026, the SANS Internet Storm Center published a YARA rule for identifying orphaned VBA projects inside DWG files, a check that can be built into the intake of engineering files.
Source: Regra YARA para detectar projetos VBA órfãos em arquivos DWG (isc.sans.edu). Text prepared with AI from this source.
What happened and what to do
The post from the SANS Internet Storm Center presents a YARA rule for detecting orphaned VBA projects, meaning VBA code embedded in AutoCAD DWG files. The author describes the rule used to locate this kind of content, which is treated as a security concern.
In practice, companies that receive drawings from suppliers, partners or clients can treat DWG files as potential carriers and add an automated scan before engineers open them. This can run YARA rules in an intake step, quarantine files that match, record the results and provide a dashboard for the security team to follow alerts. The rule can be versioned and updated as new variants are observed.
How the consultancy can help
Wendelmaques can diagnose where DWG files enter your operation, such as email, supplier portals and shared folders, and propose a YARA-based scan in a pipeline with quarantine, logging and a dashboard, deployed on your own infrastructure.
Next step
Send a short description of your case, including the channels through which project files arrive, and receive a scoped proposal to assess and implement this check.
Let's assess your project
I reply with scope and a proposal.