← All detection heuristics · General
medium
CORPUS_RARE_COMBINATION
What it means
An unusual combination of heuristics that has been flagged on at least one prior file.
Why it fires
Files that fire heuristic combinations rarely seen in the corpus are worth a closer look — especially when at least one prior occurrence was suspicious or malicious. This is a weaker signal than the historically-malicious combination, but it surfaces low-volume patterns that signature-style rules would miss.
Other General heuristics
POLYGLOT_PDF_APPENDED_ZIP_CVE_BUNDLE EXTRACTED_FILE_CLAMAV POLYGLOT_GIF_PDF_FORCEDENTRY_SHAPE SPEC_DIVERGENCE_HIGH PDF_EXTENSION_MISMATCH POLYGLOT_PDF_ZIP_APPENDED EXTRACTED_FILE_STATIC_TRIAGE CORPUS_HISTORICALLY_MALICIOUS POLYGLOT_TEXT_PDF POLYGLOT_ZIP_PREFIXED FORMAT_NEUTRAL_SCAN PPT_FOPT_COMPLEX_DATA_OVERFLOW PPT_FOPT_PROPERTY_TABLE_TRUNCATED CORPUS_RARE_STRUCTURAL_FEATURE_SET ANALYSIS_TIMEOUT_PARTIAL EMBEDDED_URL MACRO_VALID_PUBLISHER_SIGNATURE SCAN_OPTIONAL_STAGES_SKIPPED POLYGLOT_PDF_APPENDED_ZIP_SCAN_INCOMPLETE SCAN_INCOMPLETE UNKNOWN_FORMAT