← All detection heuristics · HWP
critical
HWP_OLE_CLICK_TO_EXEC_LURE
What it means
The HWP body links a temporary-path executable to an embedded OLE Package carrying the same filename.
Why it fires
The correlation connects the visible embedded-object control to the executable that HWP extracts when activated, distinguishing weaponized package delivery from an unrelated binary string.
Other HWP heuristics
HWP_EMBEDDED_PE HWP_PE_MSHTA_REMOTE_EXEC HWP_OLE_PACKAGE_EXECUTABLE HWP_PS_EXEC HWP_PS_CVX_EXEC HWP_PS_SYSTEM HWP_SHELL_CMD HWP_POSTSCRIPT HWP_PS_HEXCODE HWP_JAVASCRIPT HWP_PS_FILE HWP_URL HWP_PS_FILTER HWP_SCRIPTS_STREAM HWP_BINDATA HWP_COMPRESSED HWP_SEMANTIC_FINGERPRINT HWP_STREAM_RAW_FALLBACK