When you download a file from the internet, or receive it as an attachment, Windows adds a small piece of data to it, stored in an alternate data stream called Zone.Identifier. Windows features then react to it: SmartScreen shows a warning, Protected View opens Office documents in a restricted mode and macros from the internet can be blocked.
It is only as strong as its coverage. If the mark is missing, the protections do not trigger, so attackers look for ways to avoid it. A well-known one was to deliver files inside ISO disk images, because the files inside did not inherit the mark. Microsoft closed that gap in late 2022, and other bypasses have been fixed since.
Not every file system keeps the mark either. It is lost on FAT and exFAT volumes.
Keep Windows and Office updated, do not turn off SmartScreen or Protected View, block or warn on disk image and archive attachments where you can and be careful with files that arrive without a mark.