Orphaned VBA Projects Inside DWG Files: YARA Rule
Here is the YARA rule I used to detect " Orphaned VBA Projects Inside DWG Files ". 
Security Advisories
Official cybersecurity advisories from CISA, NCSC, SANS Internet Storm Center, FBI Cyber, and NIST. Published security notices and urgent alerts for defenders.
ISC Stormcast For Friday, October 16th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Small Agents, Smaller Blast Radius: Controlling What AI Can Do
I believe the cybersecurity industry may be approaching AI security the wrong way. 
ISC Stormcast For Thursday, October 15th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
![Panchan's Mining Island [Guest Diary]](https://isc.sans.edu/diaryimages/images/Zachary_Norwood_pic1.png)
Panchan's Mining Island [Guest Diary]
[This is a Guest Diary by Zachary Norwood, an ISC intern as part of the SANS.edu BACS program] 
Orphaned VBA Projects Inside DWG Files
Years ago I wrote diary entries about VBA code stored inside AutoCAD drawing files (.dwg). 
ISC Stormcast For Wednesday, October 14th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
October 2026 Microsoft Patch Tuesday
Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no custome
ISC Stormcast For Tuesday, October 13th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
ISC Stormcast For Monday, October 12th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Why TLP should not replace your internal information classification
The Traffic Light Protocol (TLP)[ 1 ], which is now in its second incarnation, is a wonderful standard that enables one to easily communicate whether
ISC Stormcast For Friday, October 9th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Reconstructing AI Agent Activity: Two New Scripts for Forensic Review
We just did a major update to FOR577 and added a lot of new material on day 5 about investigating AI usage in incident response. In the new material we dicsuss
ISC Stormcast For Thursday, October 8th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Scans for Atlassian vulnerablity (CVE-2026-21589)
On October 5th, Atlassian published patches&#;x26;#;xc2;&#;x26;#;xa0;for multiple products to fix an "Ar
ISC Stormcast For Wednesday, October 7th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
ISC Stormcast For Tuesday, October 6th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
More RMM Tools In the Wild
It seems that a trend started… I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused b
ISC Stormcast For Monday, October 5th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
TTY Logs and the Data it Captures
For an experiment, I created a script [ 1 ] that parses and send the TTY logs collected from actors or bots activity that run various commands after t
Get Deeper Security Advisories Intelligence
The CyberHawk platform goes far beyond news. Scan indicators, track active campaigns, monitor infostealer feeds, and access a complete analyst toolkit — all free to join.
IOC Scanner — 3.6M+ indicators
Live IOC Feed — filterable threat data
Infostealer Intelligence — live cred logs
Live Threat Map — real-time attacks
MISP Threat Feeds — CIRCL, Feodo, more
GitHub Arsenal — security tools library
Security Blog — deep-dive research
Video Courses — training and education
SOPs — SecOps procedures
Analyst Library — references and toolkits