## Investigation: Malicious Attachments

### Common File Types
1.  **.exe / .scr / .bat**: Executables. Usually blocked by gateway.
2.  **.docm / .xlsm**: Office Macros. Very common.
    *   User opens Doc -> Click "Enable Content" -> Macro runs PowerShell -> Downloads Malware.
3.  **.zip / .iso**: Containers. Used to bypass scanners.
4.  **.html**: HTML Smuggling. The file decodes itself in the browser.

### Analysis Tools
1.  **Talos File Reputation**: Check the hash.
2.  **OLEVBA**: Python tool to extract Macros from Office docs.
3.  **Any.Run / Joe Sandbox**: Detonate the file in a sandbox and watch the video.