UCF STIG Viewer Logo

The Macro Runtime Scan Scope must be enabled for all documents.


Overview

Finding ID Version Rule ID IA Controls Severity
V-223284 O365-CO-000001 SV-223284r508192_rule Medium
Description
This policy setting specifies for which documents the VBA Runtime Scan feature is enabled. If the feature is disabled for all documents, no runtime scanning of enabled macros will be performed. If the feature is enabled for low trust documents, the feature will be enabled for all documents for which macros are enabled except: - Documents opened while macro security settings are set to "Enable All Macros" - Documents opened from a Trusted Location - Documents that are Trusted Documents - Documents that contain VBA that is digitally signed by a Trusted Publisher If the feature is enabled for all documents, then the above class of documents are not excluded from the behavior. This protocol allows the VBA runtime to report to the Anti-Virus system certain high-risk code behaviors it is about to execute and allows the Anti-Virus to report back to the process if the sequence of observed behaviors indicates likely malicious activity so the Office application can take appropriate action. When this feature is enabled, affected VBA projects' runtime performance may be reduced.
STIG Date
Microsoft Office 365 ProPlus Security Technical Implementation Guide 2020-09-11

Details

Check Text ( C-24957r508190_chk )
Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016>> Security Settings "Macro Runtime Scan Scope" is set to "Enable for all documents".

Use the Windows Registry Editor to navigate to the following key:

HKCU\software\policies\microsoft\office\16.0\common\security

If the value for macroruntimescanscope is REG_DWORD = 2, this is not a finding.
Fix Text (F-24945r442072_fix)
Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016>> Security Settings "Macro Runtime Scan Scope" to "Enable for all documents".