Essential Eight RM-ML2.1 Microsoft Office macros are blocked from making Win32 API calls
What it says
Microsoft Office macros are blocked from making Win32 API calls.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishBlock Office macros from running code that interacts directly with Windows.
This control means that Microsoft Office macros are prevented from interacting directly with Windows operations, stopping them from running harmful actions on your computer. It is crucial because, without this safeguard, a malicious document could execute harmful tasks on your system just by you opening it, leading to data theft or damage.
Free. Save your status, tasks and notes.
Why it matters
If Office macros can make Win32 API calls, attackers can run native code to change system settings or exfiltrate data when a document opens.
How to implement
The IT team should configure group policy settings to block Office macros from making Win32 API calls.
This can be done using the Group Policy Management Console.
System administrators should ensure only users with a genuine business need have the capability to run macros.
This involves verifying business needs and updating permissions accordingly.
Security officers should review and document the business requirements for macro use regularly to ensure they remain valid and necessary.
IT support should periodically update Office applications to make sure they include the latest security patches that support these restrictions.
Keep it running
Regularly validate Office macro policy to ensure updates or user changes do not re-enable Win32 API calls from VBA macros.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Are macro settings configured to prevent Win32 API calls in your Office applications?
Look at
Review the Group Policy settings under 'User ConfigurationPoliciesAdministrative TemplatesMicrosoft Office Applications'.
Good evidence
Policies are set to block all macros from executing Win32 API calls, and there is documentation of business justifications for any exemptions.
- Check 2 of 2What an auditor asks for
Ask for
How do you verify that only authorised users can run macros?
Look at
Examine the Active Directory groups and permissions lists to ensure they match documented approvals for macro use.
Good evidence
The permissions align with documented business requirements, and there is an approval process in place for any changes.
Mappings
Closest match in ASD Information Security Manual: ISM-1673, Prevent Win32 API calls by Office macros, which asks for the same thing.
ASD Information Security Manual: 5 mappings
This control is equivalent to ISM-1673.
E8-RM-ML2.1 requires blocking Microsoft Office macros from making Win32 API calls, which aligns with ISM-1673's equivalent mandate. Both controls directly address the same macro-to-Win32 API interaction and have matching scope and intent, ensuring that implementing one satisfies the other.
This control partially meets ISM-1915.
E8-RM-ML2.1 demands specific configuration to block macros' Win32 API calls. ISM-1915 covers the broader governance of application configurations, which includes but is not limited to the specific hardening required by E8-RM-ML2.1.
This control partially overlaps ISM-1601.
ISM-1601 requires implementation of Microsoft ASR rules to reduce common exploit behaviours across user applications. E8-RM-ML2.1 relates directly because blocking Office macros from making Win32 API calls is an Office/macro attack surface reduction outcome that aligns with Microsoft's preventative controls and can be enforced via Microsoft security policy. However, E8-RM-ML2.1 is narrowly scoped to a specific macro capability restriction, while ISM-1601 covers implementing ASR rules more broadly across multiple attack techniques.
This control partially overlaps ISM-1667.
E8-RM-ML2.1 focuses on preventing Win32 API calls from Office macros to limit interaction with the system. ISM-1667 prohibits Office from creating child processes, a technique used by macros for payload execution. Though the methods differ, both aim to restrict macro-execution pathways.
This control partially overlaps ISM-1669.
ISM-1669 requires Microsoft Office to be blocked from injecting code into other processes. E8-RM-ML2.1 blocks Office macros from making Win32 API calls, which can otherwise be used to perform or facilitate process injection techniques. They overlap in reducing macro-enabled malicious capability, but ISM-1669 is a direct mitigation for process injection whereas the candidate broadly restricts macro-to-OS API access.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-RM-ML2.1 requires Microsoft Office macros to be blocked from making Win32 API calls, a macro restriction such a baseline would set.
- IT.PRO-07.1Restrict execution to supported, verified and authorised software with time-bound exceptionsPartially overlaps
This control partially overlaps IT.PRO-07.1.
IT.PRO-07.1 requires that only supported, verified and organisation-authorised software can execute; E8-RM-ML2.1 blocks Microsoft Office macros from making Win32 API calls, a related restriction on what macro code can do.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.