The Excel patterns falsely match non-Excel files

[jb-wisemo]

The YARA rules that are supposed to match Excel files with certain issues fail to check that the files are actually Excel files. This causes false alarms on files that are not at all Excel files. I have seen these trigger on straight MSI files (that are compound OLE files with completely different streams inside) and on an XML file which is not based on any kind of Office XML format.

These false matches were observed on VirusTotal when scanning those non-excel files.