Description
Detects a OneNote file whose contents carry an embedded compound structure, such as a script, or a nested document. Malicious OneNote attachments hide these embedded objects behind click-through warnings, so this signature flags likely phishing payloads in transit.