Microsoft today announced the launch of Guard for Office in a public preview to protect business users from threats that use malicious attachments as a means of attack.
Application protection for Office (also known as Microsoft Defender Application Guard for Office) is designed to prevent files που έχουν ληφθεί από μη αξιόπιστες πηγές από την απόκτηση αξιόπιστων πόρων access, opening them up in an isolated sandbox.
This sandbox will automatically prevent malicious files from exploiting vulnerabilities, downloading other malicious tools, or any malicious behavior.
Disable by default in supported environments
Malicious Office documents are among the most common files exploited by hackers to develop malware such as ransomware, RATs, trojans theftdata and malware downloads.
The Office Application Protection feature works with Word, Excel, PowerPoint, Microsoft 365 and will be disabled by default for clients with Microsoft 365 E5 or Microsoft 365 E5 security software.
In order for administrators to enable it, endpoints are required to execute them Windows 10 Enterprise Edition, version 2004 (20H1), with the cumulative update KB4566782 and the Application Guard activation package for Office applications installed.
Microsoft Defender ATP integration
"Office Application Protection is a limited feature that isolates unreliable documents from accessing trusted corporate resources, user IDs, and computer files," explains Microsoft.
“As a result, if a user tries to access a feature to which they are not entitled, for example by entering an picture from a local file on disk, it will fail with a prompt like the one below.
The Application Guard for Office is integrated with the Microsoft Defender Advanced Threat corporate security platform, providing monitoring of any malicious activity.
Microsoft provides detailed instructions on how to deploy and configure Application Guard for Office.
More details on installing - https://t.co/3V0D1NmoKz
- Tom Gallagher (@secbughunter) August 24
