Orphaned VBA Projects Inside DWG Files: YARA Rule
Here is the YARA rule I used to detect " Orphaned VBA Projects Inside DWG Files ". 
Search Intelligence
ISC Stormcast For Friday, October 16th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Small Agents, Smaller Blast Radius: Controlling What AI Can Do
I believe the cybersecurity industry may be approaching AI security the wrong way. 
ISC Stormcast For Thursday, October 15th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
![Panchan's Mining Island [Guest Diary]](https://isc.sans.edu/diaryimages/images/Zachary_Norwood_pic1.png)
Panchan's Mining Island [Guest Diary]
[This is a Guest Diary by Zachary Norwood, an ISC intern as part of the SANS.edu BACS program] 
Orphaned VBA Projects Inside DWG Files
Years ago I wrote diary entries about VBA code stored inside AutoCAD drawing files (.dwg). 
ISC Stormcast For Wednesday, October 14th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
October 2026 Microsoft Patch Tuesday
Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no customer actions. One vulnerability was disclos
ISC Stormcast For Tuesday, October 13th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
ISC Stormcast For Monday, October 12th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Why TLP should not replace your internal information classification
The Traffic Light Protocol (TLP)[ 1 ], which is now in its second incarnation, is a wonderful standard that enables one to easily communicate whether information may be shared further (and i
ISC Stormcast For Friday, October 9th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Reconstructing AI Agent Activity: Two New Scripts for Forensic Review
We just did a major update to FOR577 and added a lot of new material on day 5 about investigating AI usage in incident response. In the new material we dicsuss 8&#;x26;#;xc2
ISC Stormcast For Thursday, October 8th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Scans for Atlassian vulnerablity (CVE-2026-21589)
On October 5th, Atlassian published patches&#;x26;#;xc2;&#;x26;#;xa0;for multiple products to fix an "Arbitrary File Access" vulnerability &
ISC Stormcast For Wednesday, October 7th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
ISC Stormcast For Tuesday, October 6th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
More RMM Tools In the Wild
It seems that a trend started… I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat actors! A few days ago, I
ISC Stormcast For Monday, October 5th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
TTY Logs and the Data it Captures
For an experiment, I created a script [ 1 ] that parses and send the TTY logs collected from actors or bots activity that run various commands after they successfully login the DShield senso