There are a bunch of tricks to circumvent potentially malicious macros in office documents you receive. My question is how do I [forensically] detect if there are malicious macros in the documents?
- Are there sub-strings I can look for?
- Any host-side tools I can use (without having to install a virus scanner)
- Any tell-tale signs within the raw-file that would tip off something isn't quite right with the file?