Use a gated Office macro delivery chain

Needs: Compatible installed Office/macro support, a real required user interaction, executable document state and allowed macro/security policy

A minimal harmless execution proof is

Use a macro-enabled format such as .docm or a legacy .doc; .docx does not persist embedded VBA macros by itself. Store the macro in the document, not only the global template. A minimal harmless execution proof is:

' A minimal harmless execution proof is
Sub AutoOpen()
    RunProof
End Sub

Sub Document_Open()
    RunProof
End Sub

Sub RunProof()
    CreateObject("WScript.Shell").Run _
        "cmd.exe /c whoami > %TEMP%\oscp-marker.txt", 0, True
End Sub

Inspect a file's zone without changing it

AutoOpen and Document_Open cover distinct Word opening paths. Replace the proof command only after the document, trigger and execution context are confirmed.

# Inspect a file's zone without changing it
Get-Item -LiteralPath 'C:\PATH\FILE.docm' -Stream *
Get-Content -LiteralPath 'C:\PATH\FILE.docm' -Stream Zone.Identifier

Verify → Verify the actual macro-triggered effect and user context; document receipt is not execution.

If it fails → Missing Office, absent interaction, blocked internet macros or incompatible content invalidates the chosen chain. Use a method supported by the assigned scenario. More detail ↓

If → then

A simple command works while a longer or nested payload fails → Repair quoting, encoding and command-length boundaries
Needs: Known outer request/template/database parser and inner shell; correct character encoding and transport length
Command execution or payload delivery exists but the expected usable channel does not → Diagnose connection direction, listener and session failures in order
Needs: A recorded first execution proof, correct advertised route, active compatible listener and observable connection evidence
Windows execution or valid credentials with an available remote service → Use Windows authenticated access or a PowerShell command channel
Needs: Accepted remote-service rights or compatible PowerShell execution; correct encoding, policy context and callback route

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Use a gated Office macro delivery chain

USE WHEN: An assigned client-side scenario includes Office and a document-open interaction
STARTING ACCESS: A recorded delivery/execution chain with the expected consumer and effect
RESULT: A verified document-triggered command effect under the opening user's identity

Recognize the clue

From the assigned client-side scenario identify the actual Office consumer, required open/enable interaction and file-origin policy before investigating callbacks.

Get-Item .\FILE -Stream *
Get-Content .\FILE -Stream Zone.Identifier -ErrorAction SilentlyContinue

SYNTHETIC EXAMPLE OUTPUT

Zone.Identifier present
ZoneId=3
Office interaction: document opens; macro execution not observed

Means: Internet-origin metadata and absent macro execution localize an earlier gate than network connectivity.

Confirm: Check compatible Office, actual macro/user trigger and applicable policy; a delivered/opened document is not execution.

After validation: The permitted interaction triggers the expected bounded command effect: choose the supported delivery chain.
Ruled out in this context: Office/policy blocks the required macro path: reject this chain under those conditions.
Still inconclusive: A missing callback with no trigger evidence leaves execution unknown.

Troubleshooting: Missing Office, absent interaction, blocked internet macros or incompatible content invalidates the chosen chain. Use a method supported by the assigned scenario.

Use a macro-enabled format such as .docm or a legacy .doc; .docx does not persist embedded VBA macros by itself. Store the macro in the document, not only the global template. A minimal harmless execution proof is:

AutoOpen and Document_Open cover distinct Word opening paths. Replace the proof command only after the document, trigger and execution context are confirmed.

Modern Office commonly blocks VBA macros in files carrying Mark of the Web rather than offering a universal one-click enable path. Relevant gates include:

file format actually supports the macro;
macro is stored in the delivered document;
MOTW/Zone Identifier and security zone;
Protected View and Trust Center settings;
signed publisher or Trusted Location decisions;
organization GPO that the user cannot override;
user opened the document and performed the required permitted action;
Office launched the expected child process;
the child command survived VBA, CMD and PowerShell quoting;
delivery and callback network paths both work.

Inspect a file's zone without changing it:

ZoneId=3 represents the Internet zone. Absence of the stream does not prove that macro policy permits execution, and removing MOTW does not override every policy.

Why it works

Delivery, document open, macro enablement and child-process execution are separate gates. Mark of the Web and current Office policy can block a chain before any callback occurs.

Worked example · hypothetical

Observation: the document is delivered but no shell appears. Test: inspect the open/macro-trigger and policy gates first. Illustrative output: macros are blocked before the command executes. Interpretation: the callback is not yet the failed boundary.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗