AutoExec macro

AutoExec runs when Word itself starts, from the global template. It needs no document to be opened at all, so a macro that reaches Normal.dot with an AutoExec entry point executes on every launch. Rated LOW because it is a capability/context marker, not evidence of malice: it says the macro runs without the user pressing anything. Benign templates use these triggers legitimately, so a real dropper still convicts on its Shell/download/LOLBin signal — this trigger is never the sole malicious signal.