Detections
Analytics

O365-CO-000001 - The Macro Runtime Scan Scope must be enabled for all documents.

Information

This policy setting specifies for which documents the VBA Runtime Scan feature is enabled.

If the feature is disabled for all documents, no runtime scanning of enabled macros will be performed.

If the feature is enabled for low trust documents, the feature will be enabled for all documents for which macros are enabled except:
 - Documents opened while macro security settings are set to 'Enable All Macros'
 - Documents opened from a Trusted Location
 - Documents that are Trusted Documents
 - Documents that contain VBA that is digitally signed by a Trusted Publisher

If the feature is enabled for all documents, then the above class of documents are not excluded from the behavior.

This protocol allows the VBA runtime to report to the Anti-Virus system certain high-risk code behaviors it is about to execute and allows the Anti-Virus to report back to the process if the sequence of observed behaviors indicates likely malicious activity so the Office application can take appropriate action.

When this feature is enabled, affected VBA projects' runtime performance may be reduced.

Solution

Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016>> Security Settings 'Macro Runtime Scan Scope' to 'Enable for all documents'.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Office_365_ProPlus_V2R3_STIG.zip

Item Details

References: CAT|II, CCI|CCI-001170, Rule-ID|SV-223284r508192_rule, STIG-ID|O365-CO-000001, STIG-Legacy|SV-108745, STIG-Legacy|V-99641, Vuln-ID|V-223284

Plugin: Windows

Control ID: 1fb82c2c3dae66fd27b7292f54a29c3b41cfb1c208ca756349e07b9861d403d2