Macro abuse has fallen since Office began blocking macros in files from the internet, but it persists where the mark of the web is missing, in trusted locations, in older Excel 4.0 macro sheets and through files that arrive inside containers. The detection stack combines Office child processes, a registry trace of user consent and verification that the block policy is actually applied.
Signals at a Glance
| Signal | Where | ATT&CK |
|---|---|---|
| WINWORD, EXCEL or POWERPNT spawning cmd, powershell, wscript, mshta, certutil or bitsadmin | Sysmon 1, EDR | T1204.002 |
| Registry write to the Office Trusted Documents key after the user enables content | Sysmon 13, EDR | T1204.002 |
| VBA or Excel 4.0 (XLM) macro content flagged by AMSI | AMSI telemetry, EDR | T1059.005 |
| Document opened from a location without a zone marker | File inspection | T1553.005 |
| Office policy to block internet macros absent or overridden | Config audit | T1562.001 |
Office Child Processes
This remains the best single detection. Cover the indirect forms as well: scripting engines launched through living-off-the-land binaries, and Office writing an executable or script then running it:
// Defender XDR (KQL) - Office apps launching interpreters, downloaders or LOLBins
DeviceProcessEvents
| where Timestamp > ago(14d)
| where InitiatingProcessFileName in~ ("winword.exe","excel.exe","powerpnt.exe","msaccess.exe","mspub.exe")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe",
"rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","msiexec.exe","curl.exe")
| summarize runs=count(), cmds=make_set(ProcessCommandLine, 5), firstSeen=min(Timestamp)
by DeviceName, AccountName, InitiatingProcessFileName, FileName
| order by runs desc
// tune/validate: reporting add-ins and finance macros are the main benign source; allowlist by signed macro path
Consent and Policy
When a user clicks Enable Content, Office records the decision for that document. That registry write is a clean, early marker of consent, and it appears before the child process does:
title: Office Trust Record Written for Macro Enablement
logsource:
product: windows
category: registry_set
detection:
selection:
TargetObject|contains: '\Security\Trusted Documents\TrustRecords'
filter_known:
Image|endswith: '\MsiExec.exe'
condition: selection and not filter_known
level: low
# Use as a correlation anchor: a TrustRecords write followed by an Office child process on the same host is high confidence.
# tune/validate: confirm TargetObject format for your Office version and Sysmon registry config.
- Audit the policy that blocks macros in files from the internet, and alert when the setting is removed or overridden by a user or script.
- Prefer signed macros with trusted publishers for business automation, and block all other macros for users without a documented need.
- Review Excel 4.0 (XLM) macro handling separately; it runs through a different engine and has its own policy control.
Use Microsoft's guidance on blocking macros from the internet and on attack surface reduction rules for Office, SigmaHQ Office child-process rules, Elastic's Office detections and the Splunk ESCU Office-spawn analytics. Baseline your own environment — automation macros in finance and operations will appear early.
Build Detections That Fire
Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.
- Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
- Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
- 24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts