CyberHawk Threat Intel — IOC Scanner, Live IOC Feed (3.6M+ indicators),
Infostealer Intelligence, Threat Map, MISP Feeds, GitHub Arsenal, Courses and more.
Free to join.
Register Free →
Here is the YARA rule I used to detect "Orphaned VBA Projects Inside DWG Files".
rule autocad_orphaned_vba_project {
strings: $a = "AC10"
$b = {D0 CF 11 E0 A1 B1 1A E1}
$c = "[Host Extender Info]" ascii
condition: $a at 0 and uint32(0x24) == 0 and $b and $c
}
A VirusTotal retrohunt with this rule gave me only 2 detections:
09d4607941e458f6dbb6be17825641d863c0b37c185027984e137d8a67e919d8
3310c1a9bfe6115e49d8ac372cef5f460850da05138340107e66b958a6b5bca6
Didier Stevens
Senior handler
blog.DidierStevens.com
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Accelerate Your Security Operations
CyberHawk Threat Intel is a complete Cyber Intelligence Platform — one place for every tool
a security professional needs. Built by
Rudra Verma,
Senior Security Architect and Researcher, CyberHawk Consultancy.
IOC Scanner — scan any domain, IP, hash, URL
Live IOC Feed — 3.6M+ indicators, filterable
Infostealer Intelligence — live compromised creds
Live Threat Map — real-time global attack vectors
MISP Threat Feeds — CIRCL, Feodo, Botvrij, more
GitHub Arsenal — curated security tools and scripts
Security Blog — CVE advisories and threat research
Video Courses — cybersecurity training and education
SOPs and Playbooks — SecOps procedures
Analyst Library — references and toolkits
Scan Reports — historical threat intelligence
Cyber News — this feed, aggregated in-platform
