THE SANS ISC diary entry discusses a YARA rule used to detect a specific pattern described as “Orphaned VBA Projects Inside DWG Files.” The rule searches for the string “AC10” at the start, a 32-bit binary sequence at offset 0x24, a D0 CF 11 E0 A1 B1 1A E1 header, and the literal “[Host Extender Info]”. The author presents these indicators as part of a detection method rather than describing a fully weaponised exploit scenario. The entry highlights the rule’s structure and how it could be applied to identify potential DWG files containing embedded, orphaned VBA projects.
The post notes a VirusTotal retrohunt result for the rule, reporting only two detections corresponding to two specific file hashes: 09d4607941e458f6dbb6be17825641d863c0b37c185027984e137d8a67e919d8 and 3310c1a9bfe6115e49d8ac372cef5f460850da05138340107e66b958a6b5bca6. Didier Stevens provides the YARA rule and references a related diary entry on DShield, but the diary does not describe any confirmed active exploitation, payloads, or CVEs tied to the technique.
Instead, it presents the rule and a minimal evidentiary link to two detections, inviting readers to review the associated samples on VirusTotal while noting the limited detection counts in this retrohunt. Practical response guidance is not expanded upon beyond the rule itself.