← All detection heuristics · RTF
high
RTF_OBJUPDATE
What it means
RTF contains \objupdate — forces automatic OLE object activation.
Why it fires
The \objupdate control word forces Word to immediately instantiate the embedded OLE object when the document is opened, without requiring the user to double-click or interact with the object. This is a near-universal indicator of Equation Editor exploit documents — it ensures the vulnerable EQNEDT32.EXE process is spawned automatically. Legitimate use of \objupdate is extremely rare.
Other RTF heuristics
RTF_EQUATION_EDITOR RTF_OBJCLASS_EQUATION RTF_MZ_HEX RTF_DDEAUTO_REGSVR32_SCRIPTLET RTF_MACOS_ZSH_LOADER RTF_PACKAGE_AUTOLINK_DELIVERY RTF_OBJAUTLINK RTF_INCLUDE_REMOTE RTF_EXCESSIVE_HEX RTF_PACKAGE_OLE RTF_OBFUSCATION RTF_PHP_IRC_BOT_SOURCE RTF_OBJCLASS_PACKAGE RTF_REMOTE_TEMPLATE RTF_EXPLOIT_TEMPLATE_ARTIFACT RTF_OBJUPDATE_LOOSE_HEX_PAYLOAD RTF_PFRAGMENTS_RELATED RTF_OBJEMB RTF_WORD_COMPATIBILITY_PACKAGE RTF_OBJDATA RTF_OLEPRES_STREAM RTF_OLE10NATIVE_STREAM