Block Win32 API calls from Office macros

Purpose

Show registry keys (1)

• HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B

This registry value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule. DWORD data 1 enables the rule in Block mode. It prevents Visual Basic for Applications (VBA) macros in Microsoft Office from calling Win32 APIs.

The rule specifically restricts API calls made by Office macros. It does not disable all macros or prevent Office applications from running in general.

Notes

Additional effects

Blocked activity can generate EDR alerts in Microsoft Defender for Endpoint. This rule does not provide user-notification pop-ups in Block mode.

Security

Win32 APIs give VBA macros access to native Windows functionality. Malicious code can abuse this capability, for example, to launch shellcode directly in memory without first writing an executable payload to disk. Blocking these calls makes this type of fileless attack through malicious Office documents more difficult.

The rule covers only Win32 API calls from Office macros. Other macro capabilities and other Office-based attack techniques remain subject to separate security controls or ASR rules.

Possible side effects

Legitimate VBA solutions that import or call Win32 APIs can no longer perform the affected operations. Individual macros or document-based workflows that depend on those calls might therefore fail. One documented example involves Word templates whose macros launch other applications.

Notes

The rule depends on Microsoft Defender Antivirus and the Antimalware Scan Interface (AMSI). Microsoft documents support for Windows 10 version 1709 and later and for Windows 11, but not for Windows Server.

Microsoft documentation

Microsoft Learn: Attack surface reduction rules reference

Microsoft Learn: Attack surface reduction rules overview

See also

• Entry in the reference