← All detection heuristics · Office / OOXML
info
OOXML_DEFINED_NAME_NETWORK_URI
What it means
An Excel workbook defined name stores an HTTP, HTTPS, or FTP target.
Why it fires
The analyzer parses xl/workbook.xml structurally and decodes XML entities before extracting the target. Reporting integrations can legitimately retain these values, so this rule is searchable, zero-weight provenance unless code or a formula consumes the name.
Other Office / OOXML heuristics
OOXML_DEFINED_NAME_NETWORK_CONSUMED OOXML_METADATA_PRINTER_UNC_PATH