Malicious File

MITRE ATT&CK T1204.002 describes an adversary relying on a user to open or run a file to trigger execution. The file may be a document or another file type; the specific behavior that follows depends on its contents and the environment. Phishing delivery is a separate behavior (for example, T1566.001). Opening a document does not by itself mean that a macro or payload executes.