Modern electronic documents are defined by complex proprietary structured formats in which many types of objects can be embedded, not only scripts, tables, and media, but also arbitrary code. Because the opportunities to embed code are available in a myriad of ways, especially in document-exchange vectors, they provide convenient means for attackers to penetrate systems by embedding malicious code (malcode) in documents that appear innocuous. In this thesis, we study the problem of detecting malcode-bearing documents; we focus on Microsoft Word document files. We demonstrate a fully implemented system, in which we call SPARSE, that combines multiple detectors with various inspection tactics to provide improved security by identifying "zero-day" malcode embedded in the test documents. SPARSE combines both the static and the dynamic detection approaches with several novel investigation techniques. This system not only can detect the documents that harbor embedded malcode but also identifies the likely location of that code. Several techniques are presented in this integrated system for malicious document detection. First, we provide a fine-grained static parsing and modeling mechanism to separate different types of objects that are embedded in documents, without mixing them together. Second, we employ a statistical content modeling and analysis method with group-specific and a 2-class mutual information training strategies together to facilitate the detection of abnormal document content. Third, to activate and examine passive embedded objects that require human action to launch malcode, we implemented a mechanism that automatically interacts with the document to simulate user click behavior. Fourth, in order to detect stealthy embedded malcode that may mimic normal execution behavior, we develop a technique that arbitrarily changes the data values in certain sectors of Word documents to cause the malcode to fail so the stealthy malcode can be identified. Fifth, we introduce a method to locate the malicious sector with embedded malcode in a document by removing sectors one at a time while testing for the presence of the malcode. This strategy not only locates the malcode but also uses the extracted sectors containing malcode in an integrated feedback loop to update the models and to improve the accuracy of the detectors over time. Finally, we discuss two useful forensic analyses on documents: entropy analysis and the file content differences comparison that identifies malcode by comparing similar documents found on the Web. After testing thousands of both legitimate and malicious documents, we evaluate the detection performances on all detectors and methods, as well as the integrated system introduced in this thesis. The experiments show that the hybrid detection system reaches 99.53% true positive rate and 3.03% false positive rate, which is superior to using a single static (90.9% true positive rate and 0.06% false positive rate) or dynamic (88.33% true positive rate and 3.03% false positive rate) technique exclusively. Ultimately, we demonstrate that a hybrid detection system combined with various detection strategies can enhance the level of protection. Attackers who today easily craft the documents with embedded malcode will have to expend much more effort to create undetectable malcode-bearing documents.