Office / OLE heuristics

13 detection rules

← All detection heuristics

Auto-exec VBA installs script persistence with schtasks critical OLE_VBA_SCHTASKS_SCRIPT_PERSISTENCE
An auto-running macro writes a script and creates a scheduled task for it.
Auto-run macro launches an executable from a network share critical OLE_VBA_UNC_EXECUTABLE_LAUNCH
Auto-executing VBA launches an executable UNC path through Shell, Run, or CreateProcess.
XOR-decoded OLE slack contains a remote-command backdoor critical OLE_SLACK_XOR_SCRIPT_BACKDOOR
An XOR-hidden script performs network retrieval, host fingerprinting, remote command evaluation, and result posting.
VBA writes an embedded Windows script high OLE_VBA_EMITTED_SCRIPT
Constant VBA Print/Write statements reconstruct a child script.
XOR-decoded script recovered from OLE slack high OLE_SLACK_XOR_SCRIPT
Unallocated OLE bytes decode with a single-byte XOR key to validated script content.
XOR-decoded script-launch network configuration high OLE_SLACK_XOR_SCRIPT_CONFIG
Unallocated OLE bytes decode to a CScript command, JavaScript filename, and multiple URLs.
VBA decodes embedded network configuration medium OLE_VBA_BASE64_NETWORK_IOC
VBA Base64 literals decode to network locations.
Display-only EICAR VBA test info OLE_EICAR_DISPLAY_TEST
An auto-run VBA macro only reconstructs and displays the standard EICAR antivirus test string.
Excel BIFF hyperlink contains a mail recipient URI info OLE_BIFF_MAILTO_HYPERLINK
A legacy Excel HLINK record contains a mailto target.
Excel BIFF hyperlink contains a network URI info OLE_BIFF_HLINK_NETWORK_URI
A legacy Excel HLINK URL-Moniker contains an HTTP, HTTPS, or FTP target.
Excel external-workbook record contains a network URI info OLE_BIFF_EXTERNAL_WORKBOOK_URI
A legacy Excel SUPBOOK record references an HTTP, HTTPS, or FTP workbook location.
OLE metadata contains historical UNC paths info OLE_METADATA_UNC_PATH
Legacy document or printer metadata contains UNC paths.
Word table metadata contains a document-management URL info OLE_WORD_KGWEBURL
A Word 0Table/1Table KGWebUrl property contains an HTTP, HTTPS, or FTP target.