Essential Eight mitigation strategy for limiting Microsoft Office macros: disabled by default, blocked from the internet, scanned, and at ML3 only sandboxed, trusted-location or trusted-signed macros may run.
Restrict Microsoft Office macros at Maturity Level One: macros disabled for users without a demonstrated business need, internet-sourced macros blocked, macro antivirus scanning on, and macro settings locked.
Restrict Microsoft Office macros at Maturity Level Two: macros are additionally blocked from making Win32 API calls, on top of the ML1 macro restrictions.
Restrict Microsoft Office macros at Maturity Level Three: only macros that run in a sandbox, from a Trusted Location or signed by a trusted publisher may execute, with vetting before signing and annual review of trusted publishers.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.