← All detection heuristics · Office / OLE
high
OLE_SLACK_XOR_SCRIPT
What it means
Unallocated OLE bytes decode with a single-byte XOR key to validated script content.
Why it fires
Candidate keys are derived from an encoded ActiveXObject token rather than arbitrary URL brute force. A finding additionally requires multiple COM/network APIs, JavaScript grammar, a printable decoded region, and a valid absolute URL. The decoded script is carved for authenticated review.
Other Office / OLE heuristics
OLE_VBA_SCHTASKS_SCRIPT_PERSISTENCE OLE_VBA_UNC_EXECUTABLE_LAUNCH OLE_SLACK_XOR_SCRIPT_BACKDOOR OLE_VBA_EMITTED_SCRIPT OLE_SLACK_XOR_SCRIPT_CONFIG OLE_VBA_BASE64_NETWORK_IOC OLE_EICAR_DISPLAY_TEST OLE_BIFF_MAILTO_HYPERLINK OLE_BIFF_HLINK_NETWORK_URI OLE_BIFF_EXTERNAL_WORKBOOK_URI OLE_METADATA_UNC_PATH OLE_WORD_KGWEBURL