← All detection heuristics · Office / OOXML
high
OOXML_DEFINED_NAME_NETWORK_CONSUMED
What it means
A worksheet or XLM formula uses a URL-bearing defined name in a network sink.
Why it fires
The workbook both stores a network URI in a defined name and references that identifier from a formula containing HYPERLINK, WEBSERVICE, or an equivalent network function. This demonstrates active use rather than historical metadata.
Other Office / OOXML heuristics
OOXML_DEFINED_NAME_NETWORK_URI OOXML_METADATA_PRINTER_UNC_PATH