Complete Security Guide: Stop Malicious Macros with Microsoft Defender Attack Surface Reduction Rules

Why an SMB should care about Malicious Macros

More than half of today’s ransomware campaigns still arrive as weaponized Word or Excel files. One click triggers a hidden PowerShell script, disables AV, and drags in the real payload. Microsoft Defender’s Attack Surface Reduction (ASR) rules cut that chain at the first link—no extra license or software—yet most tenants leave them switched off. Ten minutes of work and you can watch Defender block rogue macros before damage begins.

Prerequisites

• Windows 10/11 Pro or Enterprise (build 1709 or later).

• Microsoft 365 Business Premium or Defender for Business/E3/E5.

1 – Start in Audit mode

1. Intune admin centre → Endpoint security > Attack surface reduction > Create policy.

2. Platform: Windows Profile: Attack surface reduction rules.

3. Name it, add a description, Next.

4. In Configuration settings, set these four macro-related rules to Audit:

   • Block Office applications from creating executable content

   • Block all Office applications from creating child processes

   • Block Win32 API calls from Office macros

   • Block Office applications from injecting code into other processes

5. Assign to All devices (or a pilot group) and Create the policy.

Audit mode records every hit without stopping the user—ideal for spotting business-critical macros before you enforce blocking.

See the attack surface reduction rules reference article for details on each rule.

2 – Watch the logs

After the policy has been live for a day, review the built-in ASR report:

1. Microsoft Defender portal → Reports > Endpoint security > Attack surface reduction rules.

2. Change Rule action to Audit to display only the events generated by your pilot.

3. Filter Rule name for the four macro rules you enabled—e.g., Block all Office applications from creating child processes.

4. Drill down into Device / User to confirm which files and users were audited.

If the report shows genuine threats and no business-critical macros, you’re ready to enforce.

3 – Flip to Block

Edit the same policy (or duplicate it) and set the four macro rules to Block, then save. Intune will push the change within an hour, and Defender will display a toast alert whenever it kills a malicious macro.

4 – Educate users and measure success

Tell staff: “Office macros that try to run hidden code are now blocked. If you see a Defender pop-up, forward the file to IT”. Check the ASR report weekly; you’ll notice the event count drop as attackers realise macros no longer work in your tenant.

Outcome

In less than a lunch break you’ve deployed Microsoft’s strongest built-in defense against Malicious Macros, closing a top ransomware doorway without spending a cent on new tools.

How PlexHosted can help

PlexHosted hardens Microsoft 365 by tuning security settings to your apps, deploying them through Intune, and delivering clear monthly reports that show your risk is dropping. Book a 30-minute call to learn more.

Book a Meeting with Us