Office Remote Template Injection

An Office document may reference a remote template that a compatible viewer fetches when opened. The starting document can lack embedded macros while the retrieved template contains macros or other malicious content; execution depends on the retrieved content and Office security configuration. This record covers that remote-template payload-delivery procedure, mapped to MITRE ATT&CK T1221.