Macro detection heuristics

Auto-exec macro runs a Base64 cell command through WMI critical OLE_VBA_CELL_WMI_PROCESS_CREATE

VBA decodes a command and Win32_Process moniker from worksheet cells and executes the command through WMI.

Embedded executable archive decoded from VBA/UserForm critical OLE_VBA_EMBEDDED_ARCHIVE_DROPPER

A VBA/UserForm hex or Base64 payload decodes to a ZIP containing executable/script content.

Executable payload staged across worksheet cells critical OOXML_STAGED_CELL_PAYLOAD

A large binary or script payload is split across a long run of Base64-encoded worksheet cells, often in a hidden sheet and often with a second XOR layer.

Macro workbook stores payload URL as Base64 cell text high OOXML_VBA_BASE64_CELL_URL

A VBA-bearing workbook cell decodes from Base64 to an HTTP(S) payload URL.

VBA workbook stores payload URL as Base64 cell text high OLE_VBA_BASE64_CELL_URL

A VBA-bearing BIFF workbook cell decodes from Base64 to an HTTP(S) payload URL.