CuraSec

tag: Malware-Detection · 3 items

Plan YARA Rule: Detecting Orphaned VBA Projects in DWG Files
2026-10-18 · SANS ISC · source ↗ #yara#malware-detection#file-analysis
  • Engineer — Learn: Highlights DWG files as a plausible malware delivery surface via embedded VBA projects — worth considering when designing file-upload scanning policies or reviewing which file types are allowed through email/storage pipelines.
  • SOC/IR — Plan: Concrete YARA rule for detecting hidden VBA projects in AutoCAD DWG files — worth adding to your YARA ruleset to improve coverage of this evasion/delivery technique; no active exploitation signals, so this is a detection gap to close this quarter rather than an urgent hunt.
  • Leader — Skip
Learn archived FPGA/ASIC Hardware Malware Detector PPA Tradeoffs Studied
2026-10-12 · arXiv cs.CR · source ↗ #hardware-security#malware-detection#research
  • Engineer — Learn: Academic research showing tree/rule-based hardware performance counter classifiers achieve near-equivalent detection with significantly lower area and power than function-based approaches — useful context if evaluating hardware-assisted malware detection for future platform design, but no change to running systems required today.
  • SOC/IR — Skip
  • Leader — Skip
Learn archived YARA-X 1.20.0 Released with 14 Improvements and 13 Bugfixes
2026-08-30 · SANS ISC · source ↗ #yara#tooling#malware-detection
  • Engineer — Learn: If YARA-X is part of your CI/CD or scanning pipeline, this routine release adds incremental improvements worth reviewing before your next scheduled upgrade — no urgent action required.
  • SOC/IR — Learn: Teams using YARA-X for threat hunting or malware triage should note the new release; check the changelog for any detection-relevant engine improvements before updating in a hunting workflow.
  • Leader — Skip