Stopping Macro and Script Malware: Office Hardening and ASR Rules

Most malware that arrives by email does not arrive as an .exe. It arrives as a Word document with a macro, a zipped JavaScript file, an HTML application, or a link that downloads one of those. The payload comes later, pulled down by the script. Block the script and the payload never arrives.

The good news is that Windows and Office already contain the switches to do this. They are just not on by default. Here is the set we deploy first.

Macros: block them from the internet, allow them by signature

Microsoft now blocks macros in Office files that carry the Mark of the Web, meaning they came from the internet or email, by default. That default can be overridden by a user who follows the unblock instructions in the file, and by policy on older Office builds. Set it by policy so it cannot be undone.

Group Policy: User Configuration > Administrative Templates > Microsoft Office 2016 > Security Settings > Trust Center > Block macros from running in Office files from the Internet, Enabled. Apply the same setting under Microsoft Word 2016, Excel 2016, PowerPoint 2016 and Access 2016. The Office ADMX templates are a free download from Microsoft.

• For the departments that genuinely need macros, sign the macros with an internal code-signing certificate and set VBA Macro Notification Settings to 'Disable all except digitally signed macros'.
• Turn off trusted locations that users can write to. A macro in a trusted folder bypasses everything.
• Disable Excel 4.0 (XLM) macros entirely: Excel > Security Settings > Trust Center > Macro Notification Settings for XLM, set to Disable without notification. Nobody writes new XLM macros; attackers do.
• In Intune, the same settings live in Settings Catalog under Microsoft Office 2016 (User) > Security Settings.

Attack Surface Reduction rules

ASR rules are part of Microsoft Defender Antivirus on Windows 10 and 11 and Server 2019 and later. Each rule blocks a specific behavior that malware relies on and legitimate software rarely does. They do not need Defender for Endpoint to run, though the portal makes reporting easier.

Deploy them in audit mode first, review Event ID 1122 in the Microsoft-Windows-Windows Defender/Operational log for what would have been blocked, add exclusions for line-of-business software, then switch to block.

1. Block all Office applications from creating child processes. This is the one that stops Word launching PowerShell.
2. Block Office applications from creating executable content.
3. Block Office applications from injecting code into other processes.
4. Block Win32 API calls from Office macros.
5. Block executable content from email client and webmail.
6. Block JavaScript or VBScript from launching downloaded executable content.
7. Block execution of potentially obfuscated scripts.
8. Block credential stealing from the Windows local security authority subsystem (lsass.exe).
9. Use advanced protection against ransomware.

# Enable a few ASR rules in block mode (1) or audit mode (2) with PowerShell
$rules = @(
  'D4F940AB-401B-4EFC-AADC-AD5F3C50688A', # Office child processes
  '3B576869-A4EC-4529-8536-B80A7769E899', # Office executable content
  'BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550', # Executable content from email
  'D3E037E1-3EB8-44C8-A917-57927947596D', # JS/VBS launching executables
  '5BEB7EFE-FD9A-4556-801D-275E5FFC04CC'  # Obfuscated scripts
)
foreach ($r in $rules) { Add-MpPreference -AttackSurfaceReductionRules_Ids $r -AttackSurfaceReductionRules_Actions Enabled }
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids

Take the script engines away from double-click

A file named invoice.js opens in Windows Script Host when double-clicked. An .hta file opens in mshtml. Neither is something a normal user ever needs to double-click. Reassociate those extensions with Notepad and the attack becomes a text file opening.

Do this with Group Policy Preferences or a login script that changes the default handler, or disable Windows Script Host entirely on machines that do not run logon scripts through it.

• Extensions to redirect to Notepad: .js, .jse, .vbs, .vbe, .wsf, .wsh, .hta. Consider .ps1 as well; PowerShell scripts should run from a console, not a double-click.
• Disable Windows Script Host with the registry value HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings\Enabled = 0. Test first; some older installers and login scripts use it.
• Block these extensions at the mail gateway too. Exchange Online: Defender portal > Policies > Anti-malware > Common attachments filter, add the list.
• Block the container formats attackers use to smuggle them past filters: .iso, .img, .vhd and .vhdx as attachments. Windows mounts these with a double-click and the files inside lose the Mark of the Web on older builds.

reg add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 0 /f
assoc .js=txtfile
assoc .jse=txtfile
assoc .vbs=txtfile
assoc .wsf=txtfile
assoc .hta=txtfile

Constrain PowerShell without breaking it

You cannot remove PowerShell; Windows and your management tools depend on it. You can make it far less useful to an attacker. Turn on logging so you can see what ran, enable Constrained Language Mode through Windows Defender Application Control or AppLocker for standard users, and remove the old version 2 engine that bypasses all of the modern logging.

1. Enable Script Block Logging: Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > Turn on PowerShell Script Block Logging.
2. Enable Module Logging for * and Transcription to a write-only network share.
3. Remove PowerShell 2.0: Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root
4. Forward the PowerShell Operational log (Event ID 4104) to your SIEM or EDR and alert on encoded commands and download cradles.

Frequently asked questions

Takeaway

Block internet macros by policy, turn on the ASR rules that stop Office and scripts from launching payloads, hand the script extensions to Notepad, and log PowerShell. Every one of these is a free setting you already own. Together they remove the delivery method behind most of what lands in an inbox.