Skip to content
attack.paths
Sign in
← LibraryTechnique entry
PAY-MACRO-OFFICEExecution

Office VBA Macro

Embedded VBA in .docm / .xlsm — Microsoft blocks Internet macros by default since 2022 but enterprise allowlists and older systems still bite.

§ Where this technique fits

PAY-MACRO-OFFICE is catalogued under the Execution tactic of the offensive-security kill-chain. It appears in 0 approved dossiers in the registry, typically.