How to block Excel macros

[RajeshPremSingh]

we have a new requirement we need to block   Excel macros for specific groups of user  anyone know how to block

[Raido_Rattameister]

Try to block threat events 39154.

[RajeshPremSingh]

Could you please tell me how to integrate the rule with Cortex XDR?

[mavraham]

Hi @RajeshPremSingh , thank you for writing to Live Community..

You can create a new malware security profile by going into Endpoints → policy management → add profile → choose OS → Malware →Office Files with Macros Examination (see screenshot attached). There, you can choose which action will be taken based on the policy you create.

After creating the profile, the next step would be to apply the new security profiles to endpoint(s).

Go into Policy Management → Add Policy → Create New → Enter policy name and select platform → Select the malware profile you created (see screenshot for example) → click next to choose which endpoints it will apply to and confirm the action.

I’ve attached links to our documentation about how to create new security profiles and apply them to endpoints in case you are looking for more information.


Hope this helps!

[Thendral_Arasu · Accepted solution]

Hello,  @mavraham  Thanks for your Response, 

It's great help for us. We followed your mentioned steps. but it only blocks any malicious macros embedded in the office.

we need to block the start and stop macro options.

If is this macro option block is possible? please let us know.

[afurze]

Hi ThendralMandu,

We do not support blocking this capability.  Cortex XDR is designed to prevent malicious applications and behaviors from running on your endpoints, it is not designed to be an endpoint control application.