Threat Actors may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by replacing the VBA source code with benign data.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.