OOXML_XLM_MACRO_IN_WORKSHEET — Excel 4.0 macro hidden in a regular worksheet part

critical OOXML_XLM_MACRO_IN_WORKSHEET

What it means

Workbook has an Auto_Open defined name and stores XLM download/exec logic inside parts declared as normal worksheets.

Why it fires

An XLM evasion that omits the xl/macrosheets/ part and any xlMacrosheet relationship, storing the Excel 4.0 macro formulas as cells in ordinary worksheet parts so macro-sheet-content-type detectors miss it. Download/exec formulas such as _xll.EXEC, PowerShell/curl, URLDownloadToFile, or ShellExecute sit directly in worksheet cells alongside an Auto_Open-class trigger. Used by 2021-era builders such as AsHkERE/EZHE.

Other Office heuristics

OLE_VBA_AFFINE_MSI_DOWNLOADER OLE_VBA_AUTOEXEC_FRAGMENTED_SHELL OLE_VBA_DESTRUCTIVE_WORKBOOK_SHUTDOWN OLE_VBA_BIDIRECTIONAL_MACROCOPY_REPLICATION OOXML_BRAND_LINK_MISMATCH_LURE CVE_2016_7262 POLYGLOT_OOXML_REL_COMMAND OLE_RAW_PCODE_CROSS_DOCUMENT_REPLICATION OLE_VBA_CROSS_WORKBOOK_REPLICATION OOXML_XLM_DANGEROUS_FN OFFICE_DEFAULT_PASSWORD_VBA_DROP_EXEC OFFICE_EMBEDDED_SWF EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE OFFICE_EMBEDDED_MACRO_OBJECT OLE_EMBEDDED_EXE OLE_VBA_EMBEDDED_PE_DROPPER OLE_ENCRYPTED_AND_MALFORMED CVE_2017_11882_EQUATION_NATIVE_CMD_RELATED CVE_2017_11882 OLE_EQUATION_OLE10NATIVE_DOWNLOADER OLE_MTEF_NATIVE_CODE_STUB OLE_EQUATION_OLE10NATIVE_SHELLCODE OLE_XLS5_LAROUX_MACRO_VIRUS OLE_VBA_XLSTART_WORKBOOK_PERSISTENCE