How to secure Microsoft Office Desktop Deployments – A Technical Guide

Overview

Microsoft has been pushing browser-based Microsoft 365 cloud for all office functions. However, their desktop office applications are just as popular as ever – especially Word, Excel and PowerPoint. Which is great news for cyber criminals as the end user workstation is a prime target for attack and often an overlooked link in any cyber security strategy.

With ransomware infections stealing terabytes of personal and corporate data, the average payment a staggering $220,298 and the average downtime of 23 days [1] the numbers soon become eye watering. Coupled with lost revenue for the 23 days downtime, recovery costs, lost productivity, reputational damage and fines for loss of data, unfortunately it can be the end for a lot of businesses. Now more than ever there is a need to protect assets or risk irrecoverable loss.

For attackers looking to compromise an organisation and manipulate an end user, leveraging familiar software is naturally preferred. Microsoft Office is used by virtually every IT enabled organisation on the planet. Malicious Office malware has surged over the past year with a 199% increase between Q3 and Q4 of 2020 alone and obviously must be seen as a serious threat by defenders. [2]

Technical fixes and Group Policy. Whereas this post is not intended as an absolute definitive guide, we do aim to give you 15 technical steps that can be taken by an organisation to reduce the risk posed by attacks. The majority of the protections outlined in this document should be implemented using Group Policy and will therefore require the ADMX templates provided by Microsoft here: https://www.microsoft.com/en-au/download/details.aspx?id=49030

Our suggested fixes.

1. Stop the 'bad' files getting to the user


It’s obvious that to be opened in Office a ‘bad’ file must arrive at a user workstation in some way. A favourite delivery method for attackers looking to distribute these nefarious documents is the classic email…. Phishing [3]. Although not a protection applied to the Office installation directly, it’s still such an important step its worth mentioning here. The best way to stop a user falling victim is to stop the document ever reaching them. By implementing Anti-malware scanning at the gateway or by blocking known extensions used by attackers (such as .docm) you can greatly reduce the employee’s exposure to these files.

7 steps.pngSpeak to us about email security solutions, and for specific guidance on securing your Microsoft 365 deployment. You can download our “7 Steps to secure Microsoft 365” guide here.

2. Update Office When Available


Security is a moving target; attackers constantly find ways to directly attack software or subvert existing controls for their own and often illicit ends. Updates not only apply functional fixes but often contain security improvements. By applying security updates in a timely manner, it is not only possible to protect an organisation from known attacks against the software itself but to implement the latest security controls released by Microsoft. Ensuring you are always running the latest version of Office is a crucial first step in protecting an organisation and reducing risk.

3. Macros


Office macros are code embedded within office documents that can be used by attackers to gain access to a user’s workstation. Written in the Visual Basic for Applications (VBA) programming language the only thing stopping attackers from doing virtually anything they wish on a user’s machine is often a single click.  

It’s unlikely that macros are required by the majority of users and therefore its preferable that an organisation restricts macros in their entirety. Where macros are required, they should be permitted only in the specific Office applications that are required and when digitally signed by Trusted Publishers using digital signing certificates.

4. Attack Surface Reduction (ASR)


In Windows 10 Microsoft introduced Attack Surface Reduction (ASR). ASR provides rule-based protection against risky behaviour at a software level; for example [4]

·       Launching executable files and scripts that attempt to download or run files;

·       Running obfuscated or otherwise suspicious scripts; and

·       Performing behaviours that apps don't usually initiate during normal day-to-day work.

ASR requires Microsoft Defender Antivirus to be running and comes with several Microsoft Office attack surface reduction rules including:

·       Block Office applications from creating child processes

·       Block Office applications from creating executable content

·       Block Office applications from injecting code into other processes

·       Block Win32 API calls from Office macros

5. Dynamic Data Exchange (DDE) & External Content


The Dynamic Data Exchange (DDE) protocol is a method of inter-application data transfer provided by Windows [6]. This means it allows applications such as Outlook and Excel to load and embed data from an external source into a document. Attackers can leverage this functionality to run external code, for example an attacker can use a custom DDE fields to interact directly with the command line and execute their own commands. In 2017, due to widespread use in malware campaigns, Microsoft officially disabled support for DDE in Word, however support for DDE in excel and outlook persists [7].

To protect against these attacks Group Policy should be used to prevent the loading of data from external sources.

6. Flash Content


Thankfully Flash was discontinued with EOL announced for December 31st, 2020. Unfortunately, this doesn’t mean it isn’t still used across a large number of organisations. Office documents allow Flash content to be embedded meaning that attackers use Flash code to target unsuspecting users. To protect against this attack flash can be blocked in Office Documents.

7. Object Linking & Embedding (OLE)


Content from other applications can be embedded into Excel Worksheets, Word Documents and PowerPoint Presentations through Object Linking & Embedding (OLE). Much like office macros users can use embedded objects such as Visual Basic (VB) and JavaScript (JS) scripts to execute their code on a user’s workstation [8]. To protect users, organisations should use Group Policy to make registry changes that disable OLE across the forementioned Office products.

8. Restrict Office DCOM


Abusing Microsoft Office Distributed Component Object Model (DCOM) is a technique used by attackers for stealthy lateral movement within a target network. DCOM works by extending the benefits of COM objects to remote computers and allowing, for example, macros to be run on remote machines.

Some examples of dangerous COM objects which DCOM functions include:

·       Excel.Application

·       Word.Application

·       MMC20.Application

·       ShellWindows

·       ShellBrowserWindow

·       Visio.Application

·       Visio.InvisibleApp

·       Outlook.Application

·       Powerpoint.Application

·       Access.Application

·       Shell.Application

These can usually be found in the Windows Registry database as a key/value pairing, and looks like this with a CLSID GUID assigned to the COM Class:

C08AFD90-F2A1-11D1-8455-00A0C91F3880

To protect against this technique, organisations can employ a variety of methods, however, they should ideally restrict access to dangerous COM object DLLs that support RPC functions and methods in Office. In addition to this, the following steps are recommended:

1. Disallow remote registry access if not required

2. Enable Domain and Private Profiles in Windows Defender Firewall

3. Harden the DCOM permissions by removing the rights of administrators from the permissions - Remote Launch and Remote Activation.

4. Hardening user access rights can prevent this attack with Group Policy (In AD driven environments)

5. Application control rules can be used as last circle of security controls to prevent vulnerable processes from spawning dangerous child processes or loading DLLs.


a.     Examples:

i.     outlook.exe -> rundll32.exe

9. ActiveX


ActiveX can be used to provide users with a rich Office experience, for example a document author can retrieve data from an internet source. However, ActiveX can also be used by attackers to execute code and access sensitive data. Recently ActiveX has been used to in office documents to trigger exploits against other Microsoft applications [9].

To provide protection from ActiveX based attacks organisations should disable all ActiveX across the Office suite.

10. Custom Add-Ins


Office document and outlook message content and external sources. Naturally, this feature can also be used by attackers to access sensitive data and execute code in a persistent manner.

To protect against this attack ideally organisations should deny Add-Ins completely, or if there is a legitimate business requirement only allow Office Add-Ins from Trusted Publishers and disable unsigned Add-Ins.

11. Use Protected View


By default, Office files originating from untrusted locations such as the internet or email attachments are opened within a sandbox environment. In uncommon situations organisations have disabled protected view, sometimes without knowing the consequences. If this is the case an attacker can deliver malicious Office files to users via the internet or email.

Organisations should ensure that they are enforcing Protected View by using GPOs.

12. Disable Running External Programs


PowerPoint allows users to run external programs through action buttons allowing attackers to execute programs or leverage existing programs to compromise a user’s workstation. Furthermore, there is no security warning when executing the program via the button making the attack invisible to users who typically look for Office security warnings.  

To protect against this attack organisations should disable action buttons via Group Policy

13. Use Office File Validation (OFV)


Office File Validation (OFV) ensures that documents opened in Office confirm to an expected standard and performs security checks on files. According to Microsoft “Office File Validation helps detect and prevent a kind of exploit known as a file format attack or file fuzzing attack” [10]. Depending on the configuration, files that appear to be malformed are blocked from opening entirely, are opened in read only mode or are opened in Protected View.

Although OFV doesn’t protect against all malformed files, Organisations should ensure they are enforcing protected view via Group Policy object to ensure users are protected from a large number of  malformed documents. [11]

14. Disable Legacy & Insecure File Types


Office has been part of our lives for over 30 years and understandably it has evolved many times since its inception in 1990, but is still required to support legacy file formats[12]. These file formats, such as the Word Document binary format (.doc) are still a favourite for attackers [13].

To protect from risk introduced by legacy and other insecure filetypes organisations should use Group Policy to prevent the filetypes being opened.

15. Test & Verify


Securing Microsoft Office deployments can be a challenging task, with so many policies and registries to modify, it can be easy to misconfigure. Changes made over time to accommodate edge-case and bespoke situations can inadvertently affect the organisations' ability to protect itself from common methods of attack.

Regular security testing can allow an organisation to identify new security risks & vulnerabilities and ensure changes have not retrospectively introduced previously identified vulnerabilities.

ConclusionThis is by no means a complete guide to everything you need to do to harden your MS Office environment but it’s a great start. If you want to know more or get  help identifying vulnerabilities in your environment speak to us on 0113 467 8855 or email us at info@precursorsecurity.com

We have a number of service offerings to help you test and secure your Office configuration.

Internal Network. Internal Network Security Assessments evaluate the security of your company’s internal systems and how likely they are to be compromised from a variety of perspectives from a malware compromised machine…

Workstation Review. A review of a standard user workstation aims to search for vulnerabilities and data which can be exploited by a unauthenticated or low privileged user account. Workstations can be the target of a number of attacks which aim to exploit the device or the user and form an important part of any organisation’s security…

GPOs and Technical References

Macro GPOs

• User Configuration\Policies\Administration Templates\Microsoft Office 2016\Security Settings (Disable all Trust Bar notifications for security issues, Disable VBA for Office applications, Macro Runtime Scan Scope)
• User Configuration\Policies\Administration Templates\Microsoft Office 2016\Security Settings\Trust Center (Allow mix of policy and user locations)
• User Configuration\Policies\Administration Templates\Microsoft Access 2016\Application Settings\Security\Trust Center (Turn off trusted documents, Turn off Trusted Documents on the network, VBA Macro Notification Settings)
• User Configuration\Policies\Administration Templates\Microsoft Access 2016\Application Settings\Security\Trust Center\Trusted Locations (Allow Trusted Locations on the network, Disable all trusted locations)
• User Configuration\Policies\Administration Templates\Microsoft Access 2016\Disable Items in User Interface\Custom (Disable commands)
• User Configuration\Policies\Administration Templates\Microsoft Excel 2016\Disable Items in User Interface\Custom (Disable commands)
• User Configuration\Policies\Administration Templates\Microsoft Excel 2016\Excel Options\Security (Scan encrypted macros in Excel Open XML workbooks)
• User Configuration\Policies\Administration Templates\Microsoft Excel 2016\Excel Options\Security\Trust Center (Block macros from running in Office files from the Internet, Trust access to Visual Basic Project, Turn off trusted documents, Turn off Trusted Documents on the network, VBA Macro Notification Settings)
• User Configuration\Policies\Administration Templates\Microsoft Excel 2016\Excel Options\Security\Trust Center\Trusted Locations (Allow Trusted Locations on the network, Disable all trusted locations)
• User Configuration\Policies\Administration Templates\Microsoft Outlook 2016\Disable Items in User Interface\Custom (Disable commands)
• User Configuration\Policies\Administration Templates\Microsoft Outlook 2016\Security\Trust Center (Apply macro security settings to macros, add-ins and additional actions, Security settings for macros)
• User Configuration\Policies\Administration Templates\Microsoft PowerPoint 2016\Disable Items in User Interface\Custom (Disable commands)
• User Configuration\Policies\Administration Templates\Microsoft PowerPoint 2016\PowerPoint Options\Security (Scan encrypted macros in PowerPoint Open XML presentations)
• User Configuration\Policies\Administration Templates\Microsoft PowerPoint 2016\PowerPoint Options\Security\Trust Center (Block macros from running in Office files from the Internet, Trust access to Visual Basic Project, Turn off trusted documents, Turn off Trusted Documents on the network, VBA Macro Notification Settings)
• User Configuration\Policies\Administration Templates\Microsoft PowerPoint 2016\PowerPoint Options\Security\Trust Center\Trusted Locations (Allow Trusted Locations on the network, Disable all trusted locations)
• User Configuration\Policies\Administration Templates\Microsoft Word 2016\Disable Items in User Interface\Custom (Disable commands)
• User Configuration\Policies\Administration Templates\Microsoft Word 2016\Word Options\Security (Scan encrypted macros in Word Open XML documents)
• User Configuration\Policies\Administration Templates\Microsoft Word 2016\Word Options\Security\Trust Center (Block macros from running in Office files from the Internet, Trust access to Visual Basic Project, Turn off trusted documents, Turn off Trusted Documents on the network, VBA Macro Notification Settings)
• User Configuration\Policies\Administration Templates\Microsoft Word 2016\Word Options\Security\Trust Center\Trusted Locations (Allow Trusted Locations on the network, Disable all trusted locations)
• User Configuration\Policies\Administration Templates\Microsoft Publisher 2016\Disable Items in User Interface\Custom (Disable commands)
• User Configuration\Policies\Administration Templates\Microsoft Publisher 2016\Security (Publisher Automation Security Level)
• User Configuration\Policies\Administration Templates\Microsoft Publisher 2016\Security\Trust Center (VBA Macro Notification Settings)

ASR GPOs & Rules

GPO

• Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction

ASR RULES

• Block executable content from email client and webmail (BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550)
• Block all Office applications from creating child processes (D4F940AB-401B-4EFC-AADC-AD5F3C50688A)
• Block Office applications from creating executable content (3B576869-A4EC-4529-8536-B80A7769E899)
• Block Office applications from injecting code into other processes (75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84)
• Block Win32 API calls from Office macro (92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B)
• Block Office communication application from creating child processes (26190899-1602-49E8-8B27-EB1D0A1CE869)

DDE GPOs & Registry Keys

Relevant Registry Keys

• HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Security (DataConnectionWarnings, RichDataConnectionWarnings, WorkbookLinkWarnings)
• HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Security (AllowDDE)

Relevant GPOs

• User Configuration\Policies\Administrative Templates\Microsoft Excel 2016\Excel Options\Security\Trust Center\External Content (Always prevent untrusted Microsoft Query files from opening, Don’t allow Dynamic Data Exchange (DDE) server launch in Excel, Don’t allow Dynamic Data Exchange (DDE) server lookup in Excel)
• User Configuration\Policies\Administrative Templates\Microsoft Word 2016\Word Options\Advanced (Update automatic links at Open)

Flash GPOs

• Computer Configuration\Policies\Administrative Templates\MS Security Guide (Block Flash activation in Office documents)

OLE Registry Hives

• HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Security (PackagerPrompt)
• HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\PowerPoint\Security (PackagerPrompt)
• HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Security (PackagerPrompt)

DCOM References

• https://attack.mitre.org/techniques/T1021/003/
• https://posts.specterops.io/lateral-movement-using-excel-application-and-dcom-enigma0x3-on-wordpress-com-d11d56e504dc  
• https://www.cybereason.com/blog/dcom-lateral-movement-techniques

ActiveX GPOs

• User Configuration\Policies\Administrative Templates\Microsoft Office 2016\Security Settings (Disable All ActiveX)

Add-In GPOs

• User Configuration\Policies\Administrative Templates\Microsoft Excel 2016\Excel Options\Security\Trust Center (Disable Trust Bar Notification for unsigned application add-ins and block them, Require that application add-ins are signed by Trusted Publishers, Disable all application add-ins)
• User Configuration\Policies\Administrative Templates\Microsoft PowerPoint 2016\PowerPoint Options\Security\Trust Center (Disable Trust Bar Notification for unsigned application add-ins and block them, Require that application add-ins are signed by Trusted Publishers, Disable all application add-ins)
• User Configuration\Policies\Administrative Templates\Microsoft Project 2016\Project Options\Security\Trust Center (Disable Trust Bar Notification for unsigned application add-ins and block them, Require that application add-ins are signed by Trusted Publishers, Disable all application add-ins)
• User Configuration\Policies\Administrative Templates\Microsoft Visio 2016\Visio Options\Security\Trust Center (Disable Trust Bar Notification for unsigned application add-ins and block them, Require that application add-ins are signed by Trusted Publishers, Disable all application add-ins)
• User Configuration\Policies\Administrative Templates\Microsoft Word 2016\Word Options\Security\Trust Center (Disable Trust Bar Notification for unsigned application add-ins and block them, Require that application add-ins are signed by Trusted Publishers, Disable all application add-ins)

Protected View GPOs

• User Configuration\Policies\Administrative Templates\Microsoft Excel 2016\Excel Options\Security\Trust Center\Protected View (Always open untrusted database files in Protected View, Do not open files from the Internet zone in Protected View, Do not open files in unsafe locations in Protected View, Set document behaviour if file validation fails, Turn off Protected View for attachments opened from Outlook)
• User Configuration\Policies\Administrative Templates\Microsoft PowerPoint 2016\PowerPoint Options\Security\Trust Center\Protected View (Do not open files from the Internet zone in Protected View, Do not open files in unsafe locations in Protected View, Set document behaviour if file validation fails, Turn off Protected View for attachments opened from Outlook)
• User Configuration\Policies\Administrative Templates\Microsoft Word 2016\Word Options\Security\Trust Center\Protected View (Do not open files from the Internet zone in Protected View, Do not open files in unsafe locations in Protected View, Set document behaviour if file validation fails, Turn off Protected View for attachments opened from Outlook)

External Program GPOs

• User Configuration\Policies\Administrative Templates\Microsoft PowerPoint 2016\PowerPoint Options\Security (Run Programs)

OFV GPOs

• User Configuration\Policies\Administrative Templates\Microsoft Excel 2016\Excel Options\Security (Turn off file validation)
• User Configuration\Policies\Administrative Templates\Microsoft PowerPoint 2016\PowerPoint Options\Security (Turn off file validation)
• User Configuration\Policies\Administrative Templates\Microsoft Word 2016\Word Options\Security (Turn off file validation)

Legacy Filetypes & GPOs

Relevant GPOs

• User Configuration\Policies\Administrative Templates\Microsoft Excel 2016\Excel Options\Security\Trust Center\File Block Settings (listed filetypes, Set default file block behavior)
• User Configuration\Policies\Administrative Templates\Microsoft PowerPoint 2016\PowerPoint Options\Security\Trust Center\File Block Settings (listed filetypes, Set default file block behavior)
• User Configuration\Policies\Administrative Templates\Microsoft Visio 2016\Visio Options\Security\Trust Center\File Block Settings (listed filetypes, Set default file block behavior)
• User Configuration\Policies\Administrative Templates\Microsoft Word 2016\Word Options\Security\Trust Center\File Block Settings (listed filetypes, Set default file block behavior)

Relevant Legacy and Insecure Filetypes

• dBase III / IV files
• Dif and Sylk files
• Excel 2 macrosheets and add-in files
• Excel 2 worksheets
• Excel 3 macrosheets and add-in files
• Excel 3 worksheets
• Excel 4 macrosheets and add-in files
• Excel 4 workbooks
• Excel 4 worksheets
• Excel 95 workbooks
• Excel 95-97 workbooks and templates
• Excel 97-2003 workbooks and templates
• Web pages and Excel 2003 XML spreadsheets
• PowerPoint 97-2003 presentations, shows, templates and add-in files
• Visio 2000-2002 Binary Drawings, Templates and Stencils
• Visio 2003-2010 Binary Drawings, Templates and Stencils
• Visio 5.0 or earlier Binary Drawings, Templates and Stencils
• Word 2 and earlier binary documents and templates
• Word 2000 binary documents and templates
• Word 2003 binary documents and templates
• Word 2007 and later binary documents and templates
• Word 6.0 binary documents and templates
• Word 95 binary documents and templates
• Word 97 binary documents and templates
• Word XP binary documents and templates

References

[1] https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound#types

[2] https://www.mcafee.com/enterprise/en-us/lp/threats-reports/apr-2021.html

[3] https://attack.mitre.org/techniques/T1566/001/

[4] https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction?view=o365-worldwide          

[5] https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-faq?view=o365-worldwide    

[6] https://docs.microsoft.com/en-us/windows/win32/dataxchg/about-dynamic-data-exchange

[7] https://www.bleepingcomputer.com/news/microsoft/windows-10-cumulative-updates-kb5001330-and-kb5001337-released/

[8] https://www.microsoft.com/security/blog/2016/06/14/wheres-the-macro-malware-author-are-now-using-ole-embedding-to-deliver-malicious-files/

[9] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26419

[10] https://insights.sei.cmu.edu/blog/effectiveness-of-microsoft-office-file-validation/

[11] https://docs.microsoft.com/en-us/previous-versions/office/office-2007-resource-kit/gg985445(v=office.12)?redirectedfrom=MSDN  

[12] https://docs.microsoft.com/en-us/deployoffice/compat/office-file-format-reference

[13] https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-doc/ccd7b486-7881-484c-a137-51170af7cc22  

‍