VBA stages a PowerShell/LOLBin download-and-run command

OLE_VBA_BITSTRANSFER_DROPPER

← All detection heuristics · Office Macros

critical OLE_VBA_BITSTRANSFER_DROPPER

What it means

VBA assembles a PowerShell/LOLBin download primitive (Start-BitsTransfer, Invoke-WebRequest, Net.WebClient, bitsadmin, certutil) that fetches a remote payload and then executes it.

Why it fires

Downloader macros split the download cmdlet, URL and command keywords with PowerShell backtick (`) / cmd caret (^) escapes and stage the command to a .cmd/.ps1 that they run via Shell.Application.Open / WScript.Shell. The detection de-escapes the source, then requires a download primitive, a URL, and an execution sink (file-write+run or auto-exec+run).

Other Office Macros heuristics

OLE_VBA_XOR_DECODED_SHELL OLE_VBA_DOCUMENT_BODY_DROP_EXEC OLE_VBA_SPLIT_KEYWORD_OBFUSCATION OLE_VBA_AUTOEXEC_NORMAL_TEMPLATE_VIRUS OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER OLE_RAW_MACRO_NATIVE_MEMORY_CALLBACK_LOADER OOXML_VBA_CELL_URL_DROPPER OLE_VBA_REACHABLE_HTTP_DROP_EXEC OLE_VBA_HTTP_DROP_EXEC OLE_VBA_HTTP_RESPONSE_COMMAND_EXEC OLE_VBA_CELL_GETOBJECT_EXEC OLE_VBA_XLM_CALL_INJECTION OLE_VBA_NATIVE_MEMORY_CALLBACK_LOADER OLE_VBA_USERFORM_CMD_DROPPER OOXML_VBA_DEFINED_NAME_NETWORK_CONSUMED OOXML_VBA_DYNAMIC_CELL_URL_SOURCE OLE_VBA_HOSTS_FILE_HIJACK OLE_VBA_KEYLOGGER_SPYWARE OOXML_VBA_CELL_IMAGE_SOURCE OLE_VBA_BARE_IPV4_LITERAL