Office / HWP heuristics

1 detection rules

← All detection heuristics

HWP unreferenced opaque trailing data low OLE_APPENDED_OPAQUE_DATA
An HWP file has a short high-entropy suffix outside declared CFB streams without a recoverable payload structure.