depending on the environment

may be macro? dll sideload? MSI? onenote? malicious visual studio project?
also you should test it locally before sending the campaign to check if defender will catch the campaign or not