Introduction

Microsoft Office documents provide attackers with a variety of ways to trick victims into running arbitrary code. Of course an attacker could try to exploit an Office vulnerability, but it is more common to send victims Office documents containing malicious macros, or documents containing embedded (Packager) executable files. 

To make these attacks harder, Microsoft has been adding security measures to Office that are aimed at protecting victims from running malicious code. A well-known measure is to open documents in Protected View when they are downloaded from the internet. Office 2016 and Office 365 contain additional security measures like a GPO to disable macros altogether when a document is downloaded from the internet. And the Packer file extension blacklist that blocks running of blacklisted file types.