office-macros

1 post tagged office-macros.

Attack Surface Reduction Rules: The Quiet Layer That Stopped Office Macros

May 25, 2026

How Microsoft built a 19-rule, kernel-mediated behaviour block list inside Windows Defender that turned the Emotet macro chain into a one-row, no-ticket telemetry event.