← All detection heuristics · Office / OLE
info
OLE_BIFF_HLINK_NETWORK_URI
What it means
A legacy Excel HLINK URL-Moniker contains an HTTP, HTTPS, or FTP target.
Why it fires
The analyzer extracts network destinations only from structurally valid BIFF HLINK records, groups repetitive query variants, and retains encoded private downstream services as provenance. Ordinary spreadsheet links are common, so this rule has zero verdict weight.
Other Office / OLE heuristics
OLE_VBA_SCHTASKS_SCRIPT_PERSISTENCE OLE_VBA_UNC_EXECUTABLE_LAUNCH OLE_SLACK_XOR_SCRIPT_BACKDOOR OLE_VBA_EMITTED_SCRIPT OLE_SLACK_XOR_SCRIPT OLE_SLACK_XOR_SCRIPT_CONFIG OLE_VBA_BASE64_NETWORK_IOC OLE_EICAR_DISPLAY_TEST OLE_BIFF_MAILTO_HYPERLINK OLE_BIFF_EXTERNAL_WORKBOOK_URI OLE_METADATA_UNC_PATH OLE_WORD_KGWEBURL