id: office-macros-not-restricted

info:
  name: Microsoft Office Macros Not Restricted
  author: boonchuan
  severity: high
  description: |
    Detected Microsoft Office macro restrictions were not configured, increasing the risk of macro-based malware delivery through Office documents.
  impact: |
    Unrestricted macros allow attackers to deliver malware through Office documents, a common initial access vector.
  remediation: |
    Configure Group Policy to disable macros: User Configuration > Administrative Templates > Microsoft Office > Security > VBA Macro Notification Settings > Disable all without notification (VBAWarnings = 4).
  reference:
    - https://www.cyber.gov.au/acsc/view-all-content/publications/essential-eight-maturity-model
    - https://learn.microsoft.com/en-us/deployoffice/security/internet-macros-blocked
  metadata:
    verified: false
  tags: windows,office,macros,compliance,essential-eight,code,windows-audit

code:
  - pre-condition: |
      IsWindows();
    engine:
      - powershell
      - powershell.exe
    args:
      - -ExecutionPolicy
      - Bypass
    pattern: "*.ps1"
    source: |
      $apps = @('Word','Excel','PowerPoint'); $unrestricted = $false; foreach ($app in $apps) { $val = (Get-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Office\16.0\$app\Security" -Name 'VBAWarnings' -ErrorAction SilentlyContinue).VBAWarnings; if ($null -eq $val -or $val -lt 3) { $unrestricted = $true } }; if ($unrestricted) { 'True' } else { 'False' }
    matchers:
      - type: word
        words:
          - "True"
# digest: 4b0a004830460221008ef29cc9a13f406e48ba33e113cbf16313826513c7902305714c9811dc0139c1022100cc65712090e08cf9ef85ce4eb684425d21c66c69b1193d2d287c60e03f725d69:922c64590222798bb761d5b6d8e72950