Microsoft Office is blocked from injecting code into other processes

Contributed by jusso-devAll contributors →

Part of ASD · Intune · Endpoint security · All checks

Run this check

Invoke-Maester -TestId ASD.ISM-1669

Overview

Microsoft Office is blocked from injecting code into other processes (ISM-1669, Essential Eight Maturity Level Two, User application hardening).

Injecting code into another process lets a macro hide its activity behind a trusted program and evade controls that watch Office. No legitimate document needs it. This check reads the attack surface reduction rules of every Intune Windows configuration policy (Endpoint security and settings catalog policies share the same setting definitions) and passes when an assigned policy sets Block Office applications from injecting code into other processes to Block. Audit and Warn only report the behaviour and do not satisfy the control.

Remediation action

1. In Microsoft Intune admin center, go to Endpoint security > Attack surface reduction and open your attack surface reduction rules policy, or create one for Windows with the profile Attack Surface Reduction Rules.
2. Set Block Office applications from injecting code into other processes to Block. Pilot the rule in Audit first if Office add-ins or line-of-business macros are in use.
3. Assign the policy to all workstations.

Related links

• Essential Eight maturity model
• Attack surface reduction rules reference
• ISM Guidelines for system hardening

Details

Every attribute of this check

Field	Value
Test ID	ASD.ISM-1669
Severity	High
Suite	ASD
Product	Intune
Related products	Defender
Feature	Endpoint security
Area	Devices and endpoints
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1055 Process Injection, T1204.002 Malicious File
Supports benchmark	ASD Essential Eight maturity model (version 2026.09.4), requirement ISM-1669
Benchmark level	ML2
Essential Eight strategy	User application hardening
Supports controls	essential-eight:ISM-1669, nist-800-53-r5:CM-7, ism:ISM-1669
PowerShell test	Test-MtAsdOfficeCodeInjectionBlocked
Services	Graph
Compatible licenses	INTUNE_A

Source

• Test: tests/asd/intune/Test.ASD.ISM-1669.ps1
• Documentation: tests/asd/intune/Test.ASD.ISM-1669.md