Hi @Alagumuthu,
you are correct, similar to many antivirus solutions, Microsoft Defender may not detect a threat within a macro until the macro is executed.
This is due to macros often containing legitimate code, and it's the actions performed during execution that may turn out to be malicious.
In the scenario you described with the EICAR test file virus content, Microsoft Defender did not initially detect it in the Word document because the macro was disabled. Once the macro was enabled and executed, Microsoft Defender successfully identified the threat.
To increase security, Microsoft has a default setting blocking macros from running in Office applications for files downloaded from the internet. Users receive a warning message when attempting to open such files, and they have the option to enable macros if necessary. However, users should be cautious about the security implications of enabling macros.
For better macro threat detection, you may need to adjust your Microsoft Defender settings or consider additional security measures. Microsoft Defender for Office 365, for instance, provides enhanced security against potentially harmful macros.
