Please see below for detailed steps on globally disabling macros.įor disabling Microsoft Office macros via Active Directory / Domain Controller The MS-ISAC recommends organizations use the CIS Benchmarks and CIS Build Kits, which are a part of CIS SecureSuite. Additionally, the digital signature acts as a way of validating who sent the document, preventing the accidental enabling of macros on a document containing a malicious payload. This setting allows you to block macros from running even if “Enable all macros” is selected in the macros settings. After evaluating your environment and appropriate testing, use Group Policy to block or disable macros from running in Microsoft Word, Excel, and PowerPoint including files downloaded from the Internet and those that are not digitally signed. RecommendationsĬonfigurations can help automatically block macros from running. CTAs utilize macros to bypass cybersecurity by obfuscating the instructions for their malicious tasks in the compressed macro file. If the user follows the prompt and enables macros, the malicious payload will automatically run, infecting your system. Once an end user opens the attachment, they are prompted to enable Macros. CTAs utilize social engineering to trick end users into opening malicious Microsoft Word or Excel attachments included in Malspam emails.
Macros are often used by cyber threat actors (CTAs) to obfuscate the delivery of malicious payloads. These instructions are compressed into a smaller form, which when used, are decompressed into the original instruction details. Macro instructions (macros) are a set of rules or instructions used to automate repetitive or complex tasks. One such legitimate part of an application is macro instructions. An examination of the characteristics of these malware variants revealed that they often abuse legitimate tools or parts of applications on a system or network. These specific malware variants have traits allowing them to be highly effective against State, Local, Tribal, and Territorial (SLTT) government networks, consistently infecting more systems than other types of malware.
The MS-ISAC observes specific malware variants consistently reaching The Top 10 Malware list.
0 kommentar(er)
