ASD.ISM-1673 - Microsoft Office macros are blocked from making Win32 API calls.
Overview
Microsoft Office macros are blocked from making Win32 API calls (ISM-1673, Essential Eight Maturity Level Two, Restrict Microsoft Office macros).
Macro malware calls the Win32 API to allocate memory, load shellcode and reach the operating system directly. Blocking those calls leaves VBA its document automation and takes away its use as a loader. This check reads the attack surface reduction rules of every Intune Windows configuration policy (Endpoint security and settings catalog policies share the same setting definitions) and passes when an assigned policy sets Block Win32 API calls from Office macros to Block. Audit and Warn only report the behaviour and do not satisfy the control.
Remediation action
- In Microsoft Intune admin center, go to Endpoint security > Attack surface reduction and open your attack surface reduction rules policy, or create one for Windows with the profile Attack Surface Reduction Rules.
- Set Block Win32 API calls from Office macros to Block. Pilot the rule in Audit first if Office add-ins or line-of-business macros are in use.
- Assign the policy to all workstations.
Related links
- Essential Eight maturity model
- Attack surface reduction rules reference
- ISM Guidelines for system hardening
Test Metadata
| Field | Value |
|---|---|
| Test ID | ASD.ISM-1673 |
| Severity | High |
| Suite | ASD |
| Product | Intune |
| Related products | Defender |
| Feature | Endpoint security |
| Area | Devices and endpoints |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1204.002 Malicious File, T1106 Native API |
| Supports benchmark | ASD Essential Eight maturity model (version 2026.09.4), requirement ISM-1673 |
| Benchmark level | ML2 |
| Essential Eight strategy | Restrict Microsoft Office macros |
| Supports controls | essential-eight:ISM-1673, nist-800-53-r5:CM-7, ism:ISM-1673 |
| PowerShell test | Test-MtAsdOfficeMacroWin32ApiBlocked |
| Services | Graph |
| Compatible licenses | INTUNE_A |
Source
- Test:
tests/asd/intune/Test.ASD.ISM-1673.ps1 - Documentation:
tests/asd/intune/Test.ASD.ISM-1673.md