The SANS Internet Storm Center (ISC) has published a YARA rule for detecting what it calls "orphaned VBA projects" inside DWG files. The rule is shared in a diary entry dated October 18th, with the rule itself provided directly in the post.
DWG is a file format used by AutoCAD, and VBA is a macro language that can be embedded in various document types. The presence of orphaned VBA projects in DWG files could indicate hidden code, though the diary entry does not elaborate on the specific threat or provide further analysis.
The rule is available at the link in the diary entry and can be incorporated into security scanning workflows. As this is a single source, there is no additional context or comparison to other detection methods.