Office Open XML Custom UI Abuse

A document-level Office RibbonX customization can add controls through an OOXML customUI part and a package-level relationship. An onAction callback for a control is invoked when the user selects it; document-level controls call code in the document, while the XML markup configures the UI and is not itself VBA. If a malicious document pairs the markup with callback code and the user opens the document and selects the control, that behavior fits ATT&CK T1204.002 (Execution: User Execution, Malicious File). The cited sources establish the format and callback capability, not this specific abuse procedure in the wild; customUI presence alone does not prove maliciousness or execution.