Cobalt Strike can query "HKEY_CURRENT_USER\Software\Microsoft\Office\<Excel Version>\Excel\Security\AccessVBOM\"  to determine if the security setting for restricting default programmatic access is enabled.