Essential Eight AH-ML2.3 Block Microsoft Office from creating executable content
What it says
Microsoft Office is blocked from creating executable content.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPrevent Microsoft Office from making executable files to stop malware.
Blocking Microsoft Office from creating executable content is like preventing it from crafting its own tools out of thin air. This control is key because it stops malicious software hiding in your documents from turning into a bigger threat. Without it, simply opening the wrong file could give hackers a way to run harmful programs on your computer.
Free. Save your status, tasks and notes.
Why it matters
If Office can create executable content (e.g., scripts/EXEs), malicious documents can drop and run malware, enabling compromise and data theft.
How to implement
System Administrator should configure Microsoft Office settings to prevent the creation of executable files by changing the group policy settings.
IT Team needs to review existing application control policies to ensure Office applications are included, implementing rules to deny creation of executable content.
Security Officer must train staff on safe document handling practices to reduce exposure to risky files and reinforce this control.
IT Manager should ensure software updates and patches for Microsoft Office that address security vulnerabilities are promptly applied.
Keep it running
Confirm Group Policy/ASR rules block Office apps from creating executable content; re-check after Office updates and test with a sample macro dropper.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Can you demonstrate how Microsoft Office is prevented from creating executable content?
Look at
Examine the group policy settings related to Microsoft Office application security.
Good evidence
The group policy shows active settings that block executable content creation in Office applications.
- Check 2 of 2What an auditor asks for
Ask for
How are staff trained to handle documents safely?
Look at
Review training logs or policy documents highlighting user awareness programs.
Good evidence
Recent training materials and attendance records confirm ongoing education efforts on document security.
Mappings
Closest match in ASD Information Security Manual: ISM-1668, Prevent Microsoft Office from creating executable files, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.7.
E8-AH-ML2.3 requires a specific technical restriction: Microsoft Office is blocked from creating executable content. ISO/IEC 27001:2022 Annex A 8.7 requires organisations to implement protection against malware more broadly (technical controls and user awareness). Implementing E8-AH-ML2.3 contributes to Annex A 8.7 as one concrete malware prevention mechanism, but Annex A 8.7 covers many additional measures beyond Office configuration.
ASD Information Security Manual: 7 mappings
This control is equivalent to ISM-1668.
ISM-1668 requires Microsoft Office to be blocked from creating executable content. E8-AH-ML2.3 specifies the same hardening outcome for Microsoft Office, namely preventing it from creating executable content. Both controls have the same technical intent and effect, with no material scope difference apparent from the statements.
This control partially overlaps ISM-1667.
ISM-1667 requires Microsoft Office to be blocked from creating child processes. E8-AH-ML2.3 addresses a related capability by blocking Office from creating executable content, which often precedes launching them as child processes. They overlap in mitigating Office-based execution chains, but ISM-1667 is about process spawning whereas E8-AH-ML2.3 is about creating executable artefacts.
This control partially overlaps ISM-1669.
E8-AH-ML2.3 requires Microsoft Office to be blocked from creating executable content to prevent initial malware execution. ISM-1669 blocks Microsoft Office from injecting code into other processes, which is another common post-exploitation technique often used after or alongside payload creation. Both controls constrain Office's ability to deliver or run malicious code, but E8-AH-ML2.3 targets creation of executables whereas ISM-1669 targets process injection behaviour regardless of whether an executable is created.
This control partially overlaps ISM-1672.
ISM-1672 requires Microsoft Office macro antivirus scanning to be enabled to detect malicious macro-enabled content. E8-AH-ML2.3 reduces macro-borne risk by blocking Microsoft Office from creating executable content, which targets a common malware delivery chain that macro malware may use after execution. The controls intersect in mitigating macro-enabled malware, but one is detection-oriented (scanning) and the other is prevention-oriented (blocking executable creation).
This control partially overlaps ISM-1673.
E8-AH-ML2.3 requires Microsoft Office to be blocked from creating executable content to prevent malware establishing or running. ISM-1673 specifically blocks Office macros from making Win32 API calls, which is one common technique used to generate or launch executable payloads from Office. Both reduce Office-based malware execution pathways, but E8-AH-ML2.3 focuses on executable content creation while ISM-1673 focuses on a macro capability (Win32 API) that may not always be required for executable creation.
This control partially overlaps ISM-1969.
ISM-1969 requires treating malicious code prior to storage or communication to prevent accidental execution. E8-AH-ML2.3 overlaps by preventing Office from creating executable content, which reduces opportunities for malicious code to be embedded and later executed when documents are stored or shared. However, ISM-1969 is about safe handling/neutralisation of known or suspected malicious code, while E8-AH-ML2.3 is a preventive hardening control for a specific application behaviour.
This control depends on ISM-1823.
E8-AH-ML2.3 requires Microsoft Office to be blocked from creating executable content, which relies on Office security settings remaining enforced. ISM-1823 requires that Office productivity suite security settings cannot be changed by users, helping ensure users cannot bypass the block implemented for E8-AH-ML2.3. Without ISM-1823 (or an equivalent enforcement mechanism), the control in E8-AH-ML2.3 may be weakened by local user changes.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-AH-ML2.3 requires Microsoft Office to be blocked from creating executable content, an Office restriction such a baseline would include.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.