← All detection heuristics · Office / OLE
info
OLE_BIFF_MAILTO_HYPERLINK
What it means
A legacy Excel HLINK record contains a mailto target.
Why it fires
The analyzer walks BIFF record boundaries and extracts mailto URIs only from structurally valid HLINK records. The target is useful contact and campaign provenance, but ordinary spreadsheet email links are common, so this rule has zero verdict weight.
Other Office / OLE heuristics
OLE_VBA_SCHTASKS_SCRIPT_PERSISTENCE OLE_VBA_UNC_EXECUTABLE_LAUNCH OLE_SLACK_XOR_SCRIPT_BACKDOOR OLE_VBA_EMITTED_SCRIPT OLE_SLACK_XOR_SCRIPT OLE_SLACK_XOR_SCRIPT_CONFIG OLE_VBA_BASE64_NETWORK_IOC OLE_EICAR_DISPLAY_TEST OLE_BIFF_HLINK_NETWORK_URI OLE_BIFF_EXTERNAL_WORKBOOK_URI OLE_METADATA_UNC_PATH OLE_WORD_KGWEBURL