ASD.ISM-1668 - Microsoft Office is blocked from creating executable content.
Overview
Microsoft Office is blocked from creating executable content (ISM-1668, Essential Eight Maturity Level Two, User application hardening).
A macro that writes an executable, script or DLL to disk is staging malware for a later step. Blocking Office from creating executable content stops the drop even when the macro itself was allowed to run. This check reads the attack surface reduction rules of every Intune Windows configuration policy (Endpoint security and settings catalog policies share the same setting definitions) and passes when assigned policies set both Block Office applications from creating executable content and Block executable content from email client and webmail to Block. Attachments opened from Outlook and webmail are covered by their own rule, so ASD's assessment process guide asks for both. Audit and Warn only report the behaviour and do not satisfy the control.
Remediation action
- In Microsoft Intune admin center, go to Endpoint security > Attack surface reduction and open your attack surface reduction rules policy, or create one for Windows with the profile Attack Surface Reduction Rules.
- Set Block Office applications from creating executable content and Block executable content from email client and webmail to Block. Pilot the rule in Audit first if Office add-ins or line-of-business macros are in use.
- Assign the policy to all workstations.
Related links
- Essential Eight maturity model
- Essential Eight assessment process guide
- Attack surface reduction rules reference
- ISM Guidelines for system hardening
Test Metadata
| Field | Value |
|---|---|
| Test ID | ASD.ISM-1668 |
| Severity | High |
| Suite | ASD |
| Product | Intune |
| Related products | Defender |
| Feature | Endpoint security |
| Area | Devices and endpoints |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1204.002 Malicious File, T1566.001 Spearphishing Attachment |
| Supports benchmark | ASD Essential Eight maturity model (version 2026.09.4), requirement ISM-1668 |
| Benchmark level | ML2 |
| Essential Eight strategy | User application hardening |
| Supports controls | essential-eight:ISM-1668, nist-800-53-r5:CM-7, ism:ISM-1668 |
| PowerShell test | Test-MtAsdOfficeExecutableContentBlocked |
| Services | Graph |
| Compatible licenses | INTUNE_A |
Source
- Test:
tests/asd/intune/Test.ASD.ISM-1668.ps1 - Documentation:
tests/asd/intune/Test.ASD.ISM-1668.md