Initial Access via Malicious Document (VBA Macros)

This record covers the macro-enabled Office document form of spearphishing attachment (ATT&CK T1566.001). Adversaries send an email with a malicious Word or Excel document to induce the recipient to open it. If Office and organizational policy permit the document's VBA macros to run, the macro can execute code and may retrieve a follow-on payload. Other attachment types also fall under T1566.001, but are outside this macro-focused entry. Payload transfer, command-and-control, and persistence are conditional downstream behaviors, not required results of attachment delivery.