## 1 Introduction
### Common Attack Vectors for Malicious Office Documents
#### 1.4.1 Entry Points-- Social Attacks to Lure a Victim to Accept a Malicious Document  
Since the release of powerful large language models, threat actors have exploited their capabilities to create realistic email messages in various languages that are difficult to distinguish from legitimate emails. In a recent article, Security Magazine [8] highlighted some noteworthy findings from a report by SlashNext. The article noted that since the release of ChatGPT in November 2022 as a user-friendly AI service, the number of malicious emails has increased by 4151% and the number of business email compromise (BEC) attacks has increased by 29% over the past six months. In these attacks, the threat actor attempts to gain the victim's trust by pretending to be a colleague or familiar person. Another method used to deceive the recipient of an email is to apply social or financial pressure, stating that there is an urgent unpaid invoice or that private data has been leaked. This illustrates that while technological advances in AI offer numerous benefits, they also provide opportunities for criminals to enhance their activities.  
The manner in which a maliciously crafted document can enter an enterprise is dependent on a number of factors. In order to trick an employee to open a specific Office document received by email, the threat actor must create an email address that, ideally, fits the apparent purpose of the email. This can be achieved by registering an account at an official online mail service, such as Gmail or Outlook or by registering a separate domain.  
A more physical and local way of bringing maldocs into an organisation is USB dropping, which is also a big threat because it is not on many people's radar. The basic approach does not require much more technical expertise than creating the malicious document--just put it on a USB stick, bring it into the company and leave it somewhere. A publicly accessible company entrance is a suitable drop-off point, but posing as an employee or facility worker can also open up opportunities to place the USB drive in a more vulnerable area. Another option is to simply put a USB stick in an envelope and perhaps be a little creative with the letter inside, thinking of a reason to check what is on the USB stick. Employees who have not been properly trained for such scenarios are likely to give in to their curiosity and open the Word document, which may have a tempting title such as Company_Secrets or Nudity_Incident.  
The placement of malevolent documents within a corporate setting may also be accomplished by an assailant who has already obtained network access and intends to extend their privileges. Gaining this kind of access allows the enumeration of SMB file shares, a topic in itself. Further information can be found in the article 'Pentesting SMB' by HackTricks [9]. The ability to place a document in a file share greatly increases the probability that an employee will open it and not perceive any vulnerability.  
A very effective but more sophisticated approach is to either manipulate an employee or actually apply for a job in the company to drop the maliciously crafted Office document somewhere on the file server. It may seem unnecessary to try this technique if you already have internal access, but it makes the initial attacker more disguised if the exploit originates from someone else. It also allows privilege escalation by trapping someone with higher privileges than oneself, further intruding the company's system.