Microsoft Announces Antivirus Feature for Microsoft Office

[nir]

Blocking malicious macros has finally become a priority

 

Microsoft has recently announced that Office 365 client applications now support the so-called Antimalware Scan Interface (AMSI) to enable antivirus engines to scan, detect, and block malicious macros.

 

Infected macros have long been one of the biggest threats for Microsoft Office users, and the software giant says this new feature should help keep users protected when working with documents.

 

The biggest benefit from AMSI is that it’s an open interface that can work with pretty much any antivirus solution, so while by default it boasts Windows Defender integration, third-party products are supported too.

 

“Within a few weeks after the release of this new instrumentation in Office VBA and the adoption by Windows Defender ATP, we saw this multiplier effect, with signals from a few hundred devices protecting several tens of thousands of devices. Because Office AMSI feature exposes behaviors of the macro irrespective of content, language, or obfuscation, signals from one part of the world can translate to protection for the rest of the globe – this is powerful,” Microsoft explains.

 

Enabled by default in Office 365

 

AMSI has already been integrated and enables in Office 365 applications like Word, Excel, PowerPoint, Access, Visio, and Publisher, though it’s worth noting that macros won’t be scanned if the security settings are set to “Enable All Macros” or documents are listed as trusted or opened from trusted locations.

 

Windows 10 users with Windows Defender up and running benefit from extra protection thanks to the cloud-based engine, which uses AMSI integration to determine whether a macro is compromised or not.

 

“When devices encounter documents with suspicious macro code, Windows Defender AV sends metadata and other machine learning features, coupled with signals from Office AMSI, to the cloud. Verdicts by machine learning translate to real-time protection for the rest of Windows Defender AV customers with cloud protection enabled,” the software giant notes.

 

AMSI is a technology that was integrated into Windows 10 back in 2015 in order to provide developers with an advanced method to request an antivirus scan for any data.

 

Source