Office / OOXML heuristics

3 detection rules

← All detection heuristics

Worksheet formula consumes a network-valued defined name high OOXML_DEFINED_NAME_NETWORK_CONSUMED
A worksheet or XLM formula uses a URL-bearing defined name in a network sink.
Excel defined name contains a network URI info OOXML_DEFINED_NAME_NETWORK_URI
An Excel workbook defined name stores an HTTP, HTTPS, or FTP target.
OOXML printer metadata contains historical UNC paths info OOXML_METADATA_PRINTER_UNC_PATH
A printerSettings part retains printable Windows printer-share paths.