Note that these open-sourced tools showcased should not be considered the de facto threat actor tooling regarding these vulnerabilities. These examples only showcase how a threat actor with a moderate to high degree of skill can create scripts or programs that allow for autonomously creating Office documents containing either vulnerability. CVE-2017-0199 The "Microsoft Office/WordPad Remote Code Execution Vulnerability" or CVE-2017-0199 allows embedded malformed Microsoft HTML Applications, or HTA, files inside RTF or rich text files to execute remote code to retrieve payloads from remote resources to further infection. One of those payloads is often that of documents containing the CVE-2017-11882 vulnerability. Much like the CVE-2017-11882 vulnerability, CVE-2017-0199 is also popular due to access to open-sourced tools or the skilled creation of such tools, such as those exhibited in Figure 11 and the fact that it takes little effort for the user to open the document, akin to auto executing macros.