I was reading a recent report about an APT and jumped into this Technique: https://attack.mitre.org/techniques/T1203/
This technique is called:
Exploitation for Client Execution
And that might match with what a macro is. However, the description says the following:
Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
I do not see how Macros are included on the "software vulnerabilities" bundle when they are clearly not.
