Essential Eight AH-ML2.2 Block Microsoft Office from creating child processes

This control is equivalent to ISM-1601.

ISM-1601 requires organisations to implement Microsoft Attack Surface Reduction rules. E8-AH-ML2.2 maps directly because an ASR rule exists to block Office applications from creating child processes, matching the candidate's stated control outcome. Implementing that ASR rule under ISM-1601 would largely satisfy E8-AH-ML2.2 for this specific behaviour.

This control is equivalent to ISM-1667.

ISM-1667 requires Microsoft Office to be blocked from creating child processes. E8-AH-ML2.2 specifies the same control outcome for Microsoft Office child process creation. The scope and intent align closely (hardening Office to prevent process-spawning tradecraft).

This control partially meets ISM-0843.

E8-AH-ML2.2 requires a specific application control hardening rule: blocking Microsoft Office from creating child processes. ISM-0843 requires application control to be implemented on workstations, providing the broader control framework and enforcement mechanism that can include rules like Office child-process blocking. ISM-0843 covers a wider set of executables and execution conditions, whereas E8-AH-ML2.2 is a targeted Office restriction within that broader application control capability.

This control partially meets ISM-0955.

E8-AH-ML2.2 requires Microsoft Office to be blocked from creating child processes as a specific preventative execution control. ISM-0955 requires application control to be implemented using specific rule types (cryptographic hash, publisher certificate or path rules), which is a broader method/control family that can be used to implement restrictions affecting what runs and how it is allowed to execute. ISM-0955 does not uniquely mandate the Office child-process restriction, but E8-AH-ML2.2 is a particular hardening outcome that can sit within an ISM-0955 application control implementation.

This control partially meets ISM-1858.

ISM-1858 requires organisations to harden IT equipment using ASD and vendor hardening guidance, applying the most restrictive guidance when conflicts occur. E8-AH-ML2.2 mandates a specific Microsoft Office hardening control (blocking Office from creating child processes) to reduce attack surface. The candidate is a specific subset of application hardening that would be implemented as part of meeting ISM-1858.

This control partially meets ISM-1859.

ISM-1859 requires organisations to harden office productivity suites in line with ASD and vendor guidance, applying the most restrictive settings where required. E8-AH-ML2.2 mandates one specific hardening configuration for Microsoft Office: blocking Office from creating child processes. This is a subset technique that can be used to meet ISM-1859, but ISM-1859 also expects broader suite hardening beyond this single mitigation.

This control partially meets ISM-2110.

ISM-2110 requires user applications to be hardened against common exploitation techniques using ASD and vendor hardening guidance, selecting the most restrictive settings where guidance conflicts. E8-AH-ML2.2 mandates a particular Microsoft Office hardening control (blocking Office from creating child processes) that would typically be included in Office hardening baselines applied to meet ISM-2110. The candidate is narrower because it is one prescriptive setting for one application suite, while ISM-2110 covers all user applications and all relevant hardening guidance.

This control partially overlaps ISM-1668.

ISM-1668 requires Microsoft Office to be blocked from creating executable content. E8-AH-ML2.2 relates by reducing Office's ability to spawn execution pathways, but it focuses on blocking child process creation rather than blocking creation of executable files. ISM-1668 can still allow child processes in some configurations, while E8-AH-ML2.2 can be met even if Office can write executable content to disk.

This control partially overlaps ISM-1669.

ISM-1669 requires Microsoft Office to be blocked from injecting code into other processes. E8-AH-ML2.2 instead requires blocking Microsoft Office from creating child processes, which addresses a different but related Office-to-process interaction used for malware execution. Both reduce Office-driven post-exploitation behaviours, but process injection and child process creation are distinct mitigations with different enforcement points.

This control partially overlaps ISM-1670.

E8-AH-ML2.2 requires blocking Microsoft Office from creating child processes to prevent Office-originated process spawning. ISM-1670 requires blocking PDF applications from creating child processes, applying the same preventative technique to a different high-risk application class often abused for initial execution. They overlap in the defensive approach (blocking child process creation) but differ in scope because one targets Office while the other targets PDF readers.

This control partially overlaps ISM-1673.

E8-AH-ML2.2 requires Microsoft Office to be blocked from creating child processes to reduce Office-based malware execution and living-off-the-land activity. ISM-1673 specifically blocks Microsoft Office macros from making Win32 API calls, which is another common technique used by malicious macros to execute payloads or evade controls. Both reduce macro-enabled attack paths in Office, but E8-AH-ML2.2 focuses on process creation, while ISM-1673 focuses on API-level macro capabilities and does not necessarily prevent non-macro Office components from spawning processes.

This control partially overlaps IT.PRO-04.1.

IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-AH-ML2.2 requires Microsoft Office to be blocked from creating child processes, an Office setting such a baseline would include.