✅ Summary
This policy applies a curated set of Microsoft Defender Attack Surface Reduction (ASR) rules across Office applications. The mix of Block and Audit actions allows for telemetry‑based tuning before enforcing more disruptive rules.
It is assigned to the group:
Group ID: E8-IBP-UserApplication
(Your "medium impact" or "Office hardening staging" group.)
It uses the Endpoint Security → Attack Surface Reduction Rules template.
🔍 Rules Enforced (Block vs Audit)
Below is a structured breakdown of each ASR rule defined in the payload.
🟥 Block Rules (Fully Enforced)
These stop high-risk behaviour outright.
1. Block all Office applications from creating child processes
blockallofficeapplicationsfromcreatingchildprocesses = block
✔ Extremely effective against macro malware
✔ Shuts down Office → cmd.exe / powershell / mshta / rundll32 chains
✔ High impact but high security return
2. Block Office applications from creating executable content
blockofficeapplicationsfromcreatingexecutablecontent = block
✔ Prevents Office from writing .exe, .dll, .ps1, .vbs, .hta, etc.
✔ Stops droppers and embedded payload generation
3. Block JavaScript or VBScript from launching downloaded executable content
blockjavascriptorvbscriptfromlaunchingdownloadedexecutablecontent = block
✔ Prevents script languages from triggering payloads
✔ Very effective for both phishing and drive‑by attacks
4. Block credentials stealing from the Windows LSASS subsystem
blockcredentialstealingfromwindowslocalsecurityauthoritysubsystem = block
✔ Prevents credential scraping behaviour
✔ Far beyond Office–but necessary for modern E8 M2+ environments
5. Block Office Communication apps from creating child processes (Teams, Outlook COMMS)
blockofficecommunicationappfromcreatingchildprocesses = block
✔ Additional protection for Outlook, Teams add-ins
✔ Complements the “block all Office apps” rule
6. Block Adobe Reader from creating child processes
blockadobereaderfromcreatingchildprocesses = block
✔ Same as your dedicated PDF hardening policy
✔ Great overlap for risk reduction
✔ You now enforce this in two policies — intentional redundancy is okay but not required
🟨 Audit Rules (Telemetry Only)
These are enabled in Audit mode so you can analyse impact before deciding to Block.
1. Block executable content from email client and webmail
*_blockexecutablecontentfromemailclientandwebmail = audit
⚠️ Blocking this can break legitimate workflows in Outlook
Audit now → Block later
2. Block Office applications from injecting code into other processes
*_blockofficeapplicationsfrominjectingcodeintootherprocesses = audit
Audit first because some Office add-ins depend on controlled injection.
3. Block execution of obfuscated scripts
blockexecutionofpotentiallyobfuscatedscripts = audit
Audit required because PowerShell frameworks (e.g., MDT/ConfigMgr scripts) sometimes get flagged.
4. Block Win32 API calls from Office macros
blockwin32apicallsfromofficemacros = audit
High value but can break internal macro solutions → good call to audit.
5. Block executable files that do not meet age/prevalence/trusted list criteria
blockexecutablefilesrunningunlesstheymeetprevalenceagetrustedlistcriterion = audit
This rule is excellent for Zero Trust workloads but can disrupt LOB applications.
6. Block process creation from PsExec and WMI commands
blockprocesscreationsfrompsexecandwmicommands = audit
Good visibility rule; blocking affects sysadmin/automation tooling.
7. Block persistence through WMI event subscription
blockpersistencethroughwmieventsubscription = audit
Blocking this can break legitimate monitoring/logging frameworks.
🎯 Why this mix of Block + Audit is ideal for Essential Eight
✔ Mature E8 M1–M2 posture
This profile provides:
multiple Office exploitation chain breaks
blocking of child processes and dropper behaviour
coverage across Word/Excel/PPT/Outlook/Teams
telemetry for tuning before enforcing stricter controls
✔ Supports a staged rollout approach
Using Block for universally safe rules and Audit for risky ones is exactly what Microsoft and ACSC recommend for:
pilot hardening rings
mixed workloads
discovering legacy dependencies
preventing business outages