How to monitor/detect Microsoft Office macro execution?

Question

Before blocking macro executions via GPO in my environment, I'm looking to monitor the macro usage. Any suggestion how to monitor the macros would be appreciated.

Thank you.

Answer 1

@Harish Parameswaran

Based on my knowledge, your requirement needs the help of tools.

Such as for Microsoft 365 apps, there is a tool "Readiness Toolkit tool" for Office add-ins and VBA.

According to the article "Use the Readiness Toolkit to assess application compatibility for Microsoft 365 Apps", this tool could crearte a VBA readiness report, including an inventory of recently opened files that use VBA macros.

For more about this tool, you could also refer to following article.
Using Office Readiness/Telemetry Tools To Plan Macro/Add-On Hardening
(Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.)

Hope this information could be helpful.

---

If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

We found that Defender Portal logs were capturing .docm/.xlsm files being opened, including their paths.

You can also check out an area in the registry which records if someone's enabled a macro file:

https://www.bleepingcomputer.com/news/security/windows-registry-helps-find-malicious-docs-behind-infections/

"Now we know that every time a user clicks on 'Enable Editing; or 'Enable Content', Microsoft Office will add the path to the document as a Registry value under the program's TrustRecords key.

We also know that if the last four bytes of the trusted document's value data is set to FF FF FF 7F it means that the user enabled macros in the document"

HKEY_CURRENT_USER\Software\Microsoft\Office\[office_version]\Word\Security\Trusted Documents\TrustRecords
HKEY_CURRENT_USER\Software\Microsoft\Office\[office_version]\Excel\Security\Trusted Documents\TrustRecords

Answer 3

@campbellkerr , I am wondering when you say "we found that Defender Portal logs were capturing .docm/.xlsm files being opened, including their paths." Could you please tell me where in the Defender Portal do I look for and find these specific logs, which node or how to generate the logs.