How to monitor/detect Microsoft Office macro execution?

Harish Parameswaran 46 Reputation points
2021-10-04T04:19:03.03+00:00

Before blocking macro executions via GPO in my environment, I'm looking to monitor the macro usage. Any suggestion how to monitor the macros would be appreciated.

Thank you.

Word Management
Word Management
Word: A family of Microsoft word processing software products for creating web, email, and print documents.Management: The act or process of organizing, handling, directing or controlling something.
896 questions
PowerPoint Management
PowerPoint Management
PowerPoint: A family of Microsoft presentation graphics products that offer tools for creating presentations and adding graphic effects like multimedia objects and special effects with text.Management: The act or process of organizing, handling, directing or controlling something.
222 questions
Excel Management
Excel Management
Excel: A family of Microsoft spreadsheet software with tools for analyzing, charting, and communicating data.Management: The act or process of organizing, handling, directing or controlling something.
1,649 questions
0 comments
Accepted answer
  1. Emily Hua-MSFT 27,536 Reputation points
    2021-10-04T08:27:17.933+00:00

    @Harish Parameswaran

    Based on my knowledge, your requirement needs the help of tools.

    Such as for Microsoft 365 apps, there is a tool "Readiness Toolkit tool" for Office add-ins and VBA.

    According to the article "Use the Readiness Toolkit to assess application compatibility for Microsoft 365 Apps", this tool could crearte a VBA readiness report, including an inventory of recently opened files that use VBA macros.

    For more about this tool, you could also refer to following article.
    Using Office Readiness/Telemetry Tools To Plan Macro/Add-On Hardening
    (Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.)

    Hope this information could be helpful.

    If an Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. campbellkerr 106 Reputation points
    2021-11-09T05:53:05.787+00:00

    We found that Defender Portal logs were capturing .docm/.xlsm files being opened, including their paths.

    You can also check out an area in the registry which records if someone's enabled a macro file:

    https://www.bleepingcomputer.com/news/security/windows-registry-helps-find-malicious-docs-behind-infections/

    "Now we know that every time a user clicks on 'Enable Editing; or 'Enable Content', Microsoft Office will add the path to the document as a Registry value under the program's TrustRecords key.

    We also know that if the last four bytes of the trusted document's value data is set to FF FF FF 7F it means that the user enabled macros in the document" 

    HKEY_CURRENT_USER\Software\Microsoft\Office\[office_version]\Word\Security\Trusted Documents\TrustRecords
HKEY_CURRENT_USER\Software\Microsoft\Office\[office_version]\Excel\Security\Trusted Documents\TrustRecords
    0 comments
  2. Phil Coombs 1 Reputation point
    2022-12-16T01:20:27.767+00:00

    @campbellkerr , I am wondering when you say "we found that Defender Portal logs were capturing .docm/.xlsm files being opened, including their paths." Could you please tell me where in the Defender Portal do I look for and find these specific logs, which node or how to generate the logs.