[Shendare]

Though in this case mitigated by the split between .docx (macro-less) documents and .docm (macro-enabled).

Either file type can also be unzipped and have their contents inspected for anything suspicious.