topic Re: How to block Excel macros in Cortex XDR Discussions

How to block Excel macros

RajeshPremSingh — Tue, 28 Mar 2023 10:25:59 GMT

we have a new requirement we need to block Excel macros for specific groups of user anyone know how to block

Re: How to block Excel macros

Raido_Rattameister — Tue, 28 Mar 2023 15:19:45 GMT

Try to block threat events 39154.

Re: How to block Excel macros

RajeshPremSingh — Tue, 28 Mar 2023 15:25:02 GMT

Could you please tell me how to integrate the rule with Cortex XDR?

Re: How to block Excel macros

mavraham — Tue, 28 Mar 2023 16:35:18 GMT

Hi @RajeshPremSingh , thank you for writing to Live Community..

You can create a new malware security profile by going into Endpoints → policy management → add profile → choose OS → Malware →Office Files with Macros Examination (see screenshot attached). There, you can choose which action will be taken based on the policy you create.

After creating the profile, the next step would be to apply the new security profiles to endpoint(s).

Go into Policy Management → Add Policy → Create New → Enter policy name and select platform → Select the malware profile you created (see screenshot for example) → click next to choose which endpoints it will apply to and confirm the action.

I’ve attached links to our documentation about how to create new security profiles and apply them to endpoints in case you are looking for more information.

Hope this helps!

Re: How to block Excel macros

Thendral_Arasu — Wed, 29 Mar 2023 07:30:41 GMT

Hello, @mavraham Thanks for your Response,

It's great help for us. We followed your mentioned steps. but it only blocks any malicious macros embedded in the office.

we need to block the start and stop macro options.

If is this macro option block is possible? please let us know.

Re: How to block Excel macros

afurze — Thu, 30 Mar 2023 14:00:06 GMT

Hi ThendralMandu,

We do not support blocking this capability. Cortex XDR is designed to prevent malicious applications and behaviors from running on your endpoints, it is not designed to be an endpoint control application.