User Execution describes an adversary relying on a person to open a file, follow a link, or otherwise interact so code runs in the user's context. This record illustrates an email-delivered file path with a benign, authorized test artifact. Phishing delivery is the separate Initial Access activity T1566; a campaign click or file open alone does not prove code execution.
Check before starting: RESTRICTED_ACCESS_BLUR_MARKER
Variant:
Full outcome coverage
Microsoft Word VBA Macro Execution · Run a named Word VBA macro
Run a named Word VBA macro
powershell
RESTRICTED_ACCESS_BLUR_MARKER
Version: RESTRICTED_ACCESS_BLUR_MARKER. Requirements: none specified (operational prerequisites may still apply)Documents all requested outcomes. This is a candidate, not proof of execution or compatibility.Shell: RESTRICTED_ACCESS_BLUR_MARKER. Privileges: not documented.preconditions: RESTRICTED_ACCESS_BLUR_MARKERdependencies: RESTRICTED_ACCESS_BLUR_MARKERverification: RESTRICTED_ACCESS_BLUR_MARKERfailure modes: RESTRICTED_ACCESS_BLUR_MARKERlimitations: RESTRICTED_ACCESS_BLUR_MARKER