← All detection heuristics · Office / Embedded script
critical
OOXML_TEXT_SCRIPT_STAGER
What it means
Word body text contains an entity-escaped MSScriptControl/ActiveX loader with encoded script stages.
Why it fires
Some malicious DOCX files render an HTML/JScript/VBScript loader as ordinary Word text, keeping it outside VBA and relationship scanners. The detector entity-decodes the text, recognizes the cross-language ScriptControl execution chain, decodes bounded Base64/reversed stages, carves them for authenticated preview, and surfaces their active URLs and commands.