How to Get Malicious Macros Past Email Filters

This advisory demonstrates practical techniques for weaponizing Microsoft Office macros to bypass email filters and sandboxes—covering legacy .doc formatting, invoking Shell.Application to fetch and open remote HTA payloads via WebDAV, generating HTA payloads (e.g., with PowerShell Empire), and writing payloads to target-specific file paths to evade sandbox environments; it warns defenders about the risk of allowing externally sourced macro-enabled documents.