Macro Malware Guide: Office Macros, Blocking Policies and Detection

Macro malware is malicious code written in a document's built-in automation language, usually Visual Basic for Applications (VBA) or the older Excel 4.0 (XLM) macro language, that runs when a user opens a Word, Excel or other Office file and allows its macros. In plain terms, the document becomes the program: a convincing invoice asks the reader to "enable content", and the macro launches the next stage. Microsoft's 2022 change to block macros in files from the internet by default cut off the easiest route, but macros still matter wherever that block is bypassed, disabled for business reasons or absent on older Office versions. This guide explains how macro malware works, which Group Policy and Intune settings control it, how attack surface reduction (ASR) rules and AMSI catch what slips through, and how to measure the result. It is for endpoint, email and Microsoft 365 administrators and SOC analysts, and contains no macro code or attacker procedures.

Key takeaways

• Disabling macros is the only complete fix. The NCSC states that disabling macros in all Office apps is the only effective protection; everything else reduces risk for the users who still need them.
• The internet block depends on Mark of the Web. Office blocks VBA macros in files carrying the Internet zone marker (ZoneId 3), so anything that strips or never receives that marker, such as some container files and sync paths, sidesteps the default.
• Enforce by policy, not by default. Set "Block macros from running in Office files from the Internet" and "VBA Macro Notification Settings" centrally, because defaults differ by version, channel and licence and perpetual Office 2019 and LTSC 2021 do not carry the change.
• Exceptions are the attack surface. Trusted locations, trusted publishers and Trusted sites zone entries all turn the block off for whatever lands there, so keep them few, write-protected and reviewed.
• Behaviour controls catch the rest. Office ASR rules (child processes, executable content, injection, Win32 API calls) and AMSI runtime scanning of VBA and XLM stop the next stage even when a macro does run.

What it is

A macro is a stored set of instructions that automates work inside an Office application: formatting a report, pulling data from another workbook, filling a template. Full access to the Office object model, and through it to Windows, also makes macros a malware delivery vehicle. Macro malware is therefore not one family but a technique: a document whose embedded macro acts as a downloader, dropper or launcher for something else. See the Malware Loaders and Droppers Guide for what typically follows.

Two macro languages matter to defenders:

• VBA: the macro language across Word, Excel, PowerPoint, Access, Visio, Publisher and Project. Macro-capable file types include .docm, .xlsm, .pptm and the legacy binary formats (.doc, .xls, .ppt), plus templates (.dotm, .xltm) and add-ins (.xlam, .ppam).
• Excel 4.0 (XLM) macros: a much older formula-based macro language stored in macro sheets inside a workbook. Microsoft still supports XLM but encourages migration to VBA, and the Trust Center option "Enable Excel 4.0 macros when VBA macros are enabled" links XLM behaviour to the VBA setting.

In MITRE ATT&CK the pattern spans several techniques: delivery by Spearphishing Attachment (T1566.001), user execution of a Malicious File (T1204.002), execution through Visual Basic (T1059.005), and persistence through Office Template Macros (T1137.001).

How it works

A macro attack is a chain, and each link is a place to break it.

How Office decides whether a macro runs

Windows attaches Mark of the Web (MOTW), an alternate data stream named Zone.Identifier, to files downloaded from the Internet or Restricted sites zones on NTFS volumes. Microsoft documents the ZoneId values as 0 My Computer, 1 Local intranet, 2 Trusted sites, 3 Internet and 4 Restricted sites; macros are blocked by default for ZoneId 3 and allowed for ZoneId 2. When a user opens a blocked file, Office shows a Security Risk banner with a Learn More button instead of the old Enable content option.

Several conditions skip the MOTW check entirely: files opened from a Trusted Location, VBA signed by a trusted publisher, and, according to Microsoft, files saved through OneDrive or SharePoint "Open in Desktop App", the OneDrive sync client or known folders synced to OneDrive, which do not receive MOTW. This is why attackers moved to archive and disk-image containers and to other file types; see the ISO and Container File Malware Delivery Guide, the Malicious LNK Files Guide and the OneNote Malware Delivery Guide.

The 2022 default change

Microsoft changed Access, Excel, PowerPoint, Project, Publisher, Visio and Word on Windows to block internet macros by default. Microsoft lists Current Channel version 2206 (27 July 2022), Monthly Enterprise Channel 2208 (11 October 2022) and Semi-Annual Enterprise Channel 2208 (10 January 2023), with Publisher and Project following later. The change does not apply to Office on Mac, Android, iOS or the web, and the NCSC notes that perpetual versions such as Office 2019 and LTSC 2021 do not have it.

Why it matters

Macro documents remain a cheap first stage because they arrive by email, a channel every organisation must keep open. See the Malware Guide for the wider families and the Ransomware Prevention Guide for how initial access becomes encryption.

The controls, setting by setting

Microsoft places both macro policies per application under User Configuration\Policies\Administrative Templates\Microsoft <App> 2016\<App> Options\Security\Trust Center. They can be deployed with Group Policy (Office ADMX/ADML), Microsoft Intune (Settings catalog or Administrative Templates) or Cloud Policy in the Microsoft 365 Apps admin center. Microsoft notes the internet block policy applies to Microsoft 365 Apps for enterprise, not Microsoft 365 Apps for business.

Behaviour blocking: ASR rules and AMSI

When a macro does run, Microsoft Defender ASR rules restrict what it can do next. They require Microsoft Defender Antivirus in active mode with real-time and cloud protection on. See the Windows Endpoint Hardening Guide for ASR deployment in general.

The Antimalware Scan Interface (AMSI) supports VBA and XLM in Microsoft 365 Apps. Microsoft describes the VBA integration as logging COM and Win32 calls with their parameters in a buffer; when a high-risk call such as CreateProcess or ShellExecute is reached, Office pauses the macro and passes the logged behaviour to the antimalware provider.

Rolling it out

1. Inventory first: work with business units and software suppliers to find macros that are actually used, where they are stored and whether they can be signed.
2. Split populations: put users who need no macros in a group with "Disable all without notification" and XLM blocked.
3. Enable the internet block for everyone: it applies even to macro users, because legitimate business macros rarely need to arrive from the internet.
4. Provide one sanctioned path: sign internal macros with a certificate you control and trust only that publisher, or use one admin-writable Trusted Location. Prefer signing; see the Code Signing Security Guide.
5. Pilot ASR in Audit: deploy the Office rules in Audit mode to a pilot ring, review event 1122 and the ASR report for two to four weeks, add narrow per-rule exclusions, then move to Block.
6. Roll back safely: if a business process breaks, move only the affected rule or group back to Audit or add a scoped exclusion; do not disable the internet block tenant-wide. Microsoft's Unblock checkbox or Unblock-File removes MOTW for a single verified file.
7. Plan retirement: the NCSC suggests replacing macros with Power Automate, Office Scripts or Power Query.

Small vs large organisations: a small business with no macro dependency can block macros and XLM for everyone and enable the Office ASR rules in Block after a short audit period. A large organisation usually needs a macro register, a signing service, a few owned trusted locations and a documented exception process with expiry dates.

Common misconceptions

• "Microsoft blocks macros now, so we are covered": the default covers Windows Microsoft 365 Apps from specific versions only, depends on MOTW, and is overridden by any explicit policy someone set to Disabled. Check effective policy on devices.
• "Signed means safe": the NCSC notes that "only signed macros" lets any validly signed macro run, and you cannot restrict it to a list of publishers. Use "Require macros to be signed by a trusted publisher" and trust only certificates you control.
• "Trusted locations on a shared drive are fine": a broadly writable share listed as trusted is a place where anyone, including malware on one machine, can plant macros that run unchallenged and, by default, unscanned.
• "Audit mode is protection": ASR rules left in Audit indefinitely only record attacks. A typical failure is finding event 1122 entries after an incident that show the rule would have stopped it.
• "Macros are the whole problem": once macros were blocked, delivery shifted to shortcut files, containers, OneNote and add-ins. See the Malicious Office Add-ins Guide.

Related concepts

Detection and measurement

• ASR events: Microsoft-Windows-Windows Defender/Operational event 1121 (ASR rule fired in block mode), 1122 (audit mode) and 5007 (antimalware configuration changed, worth alerting on if unexpected). In Defender advanced hunting, DeviceEvents with ActionType values such as AsrOfficeChildProcessBlocked or AsrOfficeMacroWin32ApiCallsAudited.
• Process lineage: alert on WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE or OUTLOOK.EXE spawning script hosts or shells, and on Office writing executables to user-writable paths. See the Endpoint Telemetry Guide.
• Email layer: count macro-enabled attachments received, blocked and delivered. See the Email Security Guide and the Microsoft 365 Security Guide.

Metrics that show it is working: percentage of devices with the internet block enforced by policy (target 100); percentage of users on "Disable all without notification"; number of Trusted Locations and trusted publisher certificates (trend down, each with an owner); Office ASR rules in Block as a share of all Office rules; ASR block events per month and their triage time; macro-enabled attachments delivered to inboxes per month.

Framework mapping

Where identity fits

Trusted publisher certificates are machine credentials: whoever holds the private key can make any macro run across the estate. Store signing keys in an HSM or managed signing service, restrict who can sign, and rotate on staff changes. Macro-delivered infostealers also target browser sessions and tokens, so a confirmed macro execution should trigger session revocation; see the Infostealer Threat Guide.

Practitioner checklist

• Enable "Block macros from running in Office files from the Internet" for every Office app by Group Policy, Intune or Cloud Policy, and verify the effective setting on devices.
• Set "VBA Macro Notification Settings" to "Disable all without notification" for users with no macro need, and to trusted-publisher-only for the rest.
• Block Excel 4.0 (XLM) macros by policy.
• Keep a macro register with owners; sign approved macros with a certificate you control and trust only that publisher.
• Remove network Trusted Locations; keep any remaining ones admin-writable only and set Macro Runtime Scan Scope to "Enable for all documents".
• Deploy the six Office and script ASR rules in Audit to a pilot ring, then Block, with narrow per-rule exclusions.
• Alert on events 1121 and 5007, Office spawning script hosts, and changes to trusted locations or publishers.
• Block or quarantine macro-enabled attachments from external senders at the email gateway.
• Upgrade perpetual Office versions that lack the internet block, or compensate with explicit policy.

Standards and references

• Microsoft Learn: Macros from the internet are blocked by default in Office
• Microsoft Learn: Attack surface reduction rules reference
• NCSC: Macro security for Microsoft Office
• Microsoft Security Blog: Office VBA + AMSI, parting the veil on malicious macros
• Microsoft Learn: Antimalware Scan Interface and Microsoft Defender Antivirus
• Microsoft Support: Working with Excel 4.0 macros
• MITRE ATT&CK: Visual Basic (T1059.005)
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Malware Guide · Windows Endpoint Hardening Guide · Microsoft 365 Security Guide · Malicious LNK Files Guide · Malicious Office Add-ins Guide