Enablement

by xyptonize Forensics A counterpart agent's mailbox took a "Delegation Enablement Pack": a macro-enabled Word document that, on open, rebuilds the counterpart's standing-delegation token and reports it to a Registry endpoint. Compliance caught it before it ran. Nobody enabled content.

The document does not store the token. It reconstructs it from material it carries inside itself, and the macro spells out every step. Read what it would have done and do it by hand. The token it would have sent is your flag.

The handout is password-protected with the password infected.