Executing Shellcode in Word Memory

A malicious Office VBA macro can allocate executable memory in the current WINWORD.EXE process, copy shellcode into that memory, and execute it in the same process. This is reflective code loading (T1620), not injection into a separate process, and it can run without creating a separate payload process. Opening a malicious document (T1204.002) and executing VBA (T1059.005) are distinct behaviors that may precede the in-memory load.