← All detection heuristics · Office / OLE
info
OLE_WORD_KGWEBURL
What it means
A Word 0Table/1Table KGWebUrl property contains an HTTP, HTTPS, or FTP target.
Why it fires
The analyzer recovers bounded UTF-16 URLs only when they follow Word's KGWebUrl property marker. The target is document-management or campaign provenance and has zero verdict weight unless another rule proves active retrieval or execution.
Other Office / OLE heuristics
OLE_VBA_SCHTASKS_SCRIPT_PERSISTENCE OLE_VBA_UNC_EXECUTABLE_LAUNCH OLE_SLACK_XOR_SCRIPT_BACKDOOR OLE_VBA_EMITTED_SCRIPT OLE_SLACK_XOR_SCRIPT OLE_SLACK_XOR_SCRIPT_CONFIG OLE_VBA_BASE64_NETWORK_IOC OLE_EICAR_DISPLAY_TEST OLE_BIFF_MAILTO_HYPERLINK OLE_BIFF_HLINK_NETWORK_URI OLE_BIFF_EXTERNAL_WORKBOOK_URI OLE_METADATA_UNC_PATH