← All detection heuristics · Office / OOXML
info
OOXML_METADATA_PRINTER_UNC_PATH
What it means
A printerSettings part retains printable Windows printer-share paths.
Why it fires
Printer drivers commonly preserve server and queue names inside Office documents. These paths are exposed as zero-weight provenance and are kept separate from active external SMB relationships.
Other Office / OOXML heuristics
OOXML_DEFINED_NAME_NETWORK_CONSUMED OOXML_DEFINED_NAME_NETWORK_URI