PH!SH Framework
Framework / Techniques /Malicious Attachment
Sub-technique Payload Delivery

Office Files

Microsoft Office files (.docx, .xlsm, .pptm) contain malicious macros that execute scripts when enabled. Attackers often use social engineering prompts to convince users to enable macros, triggering payload delivery.

Mapped to
MITRE ATT&CK®
T1566.001Spearphishing Attachment T1204.002Malicious File T1059.005Visual Basic

Connected in PH!SH

Themes
TH0005Document Sharing Service Impersonation TH0015Invoice Phishing TH0016Supply Chain Fraud