KeyWright Security

Security tools for organisations on Microsoft 365

Sign the macros you rely on. Block the rest.

One click on “Enable Content” has opened the door to some of the most damaging attacks of the last decade. Macro Signing by KeyWright Security lets Office run only the macros your organisation has checked and signed with its own certificate, and silently refuse everything else, while you phase macros out for good.

How Macro Signing works Read the case studies

  1. Root certificate authority

    Subject
    CN=Example Agency Root CA
    Issuer
    Self-signed, one per organisation
    Key
    RSA 4096, SHA-256

  2. Code signing certificate

    Subject
    CN=Example Agency Macro Signing
    Issued by
    Example Agency Root CA
    Key
    RSA 4096, SHA-256
    Valid
    7 Oct 2026 to 7 Oct 2031

  3. Signed workbook

    File
    quarterly-forecast.xlsm
    VBA signatures
    Legacy Agile V3
    Timestamp RFC 3161
    2026-10-07T09:41:27Z, DigiCert
    Server check
    Signature verified

Case studies

What one macro has cost

Four well-documented campaigns. Each began with an ordinary-looking Office attachment and a person who clicked “Enable Content”.

  1. December 2015 · Ukraine

    The power grid attack that started with a spreadsheet

    Staff at three regional electricity distributors received spear-phishing emails carrying Word and Excel files. Enabling the macros installed the BlackEnergy malware and gave the attackers their foothold. Months later they used that access to open breakers remotely; about 225,000 customers lost power for up to six hours. The joint SANS and E-ISAC analysis traced the whole chain back to those macro-enabled attachments.

    Documented in Analysis of the Cyber Attack on the Ukrainian Power Grid, SANS ICS and E-ISAC, March 2016.

  2. 2014 to 2021 · worldwide

    Emotet: the macro that rented out your network

    Emotet spread almost entirely through Word documents with macros, dressed up as invoices, shipping notices and replies to real email threads. Once inside, it sold access to ransomware crews. In 2018 the US government’s computer emergency readiness team (US-CERT, now CISA) described it as among the most costly and destructive malware affecting governments and businesses, with clean-up costs of up to US$1 million per incident. The Australian Cyber Security Centre issued a national advisory in October 2019 as it spread through Australian organisations. A Europol-coordinated operation across eight countries took its infrastructure down in January 2021.

    US-CERT alert TA18-201A (July 2018); ACSC advisory 2019-131; Europol, January 2021.

  3. 2014 onwards · banking

    Dridex: a Word macro and US$100 million in losses

    The Dridex banking trojan arrived as a Word attachment whose macro fetched the malware. It harvested online banking credentials from businesses across the UK, the US and Europe. When the US Department of Justice charged the group behind it in December 2019, it put the losses at more than US$100 million, and the US Treasury sanctioned the operators.

    US Department of Justice indictment and Treasury sanctions, December 2019.

  4. 2008 to 2023 · ransomware

    Qakbot: 700,000 infected computers

    For fifteen years Qakbot was delivered by malicious email attachments, for most of that time Office documents whose macros ran the moment a user enabled them, later Excel 4.0 macro sheets and, once Office began blocking macros by default, other lures. It became the entry point for ransomware gangs. When the FBI-led operation dismantled it in August 2023, the botnet had more than 700,000 infected computers, and its operators had taken about US$58 million in ransom payments from victims in just eighteen months.

    US Department of Justice, Operation Duck Hunt, August 2023.

The pattern is the same every time. The attacker does not need a flaw in Office. They need a document, a plausible story and one person who clicks “Enable Content”. Training lowers that chance; it never removes it.

Why sign

The safer path while you phase macros out

Most organisations want to be rid of macros. Few can switch them all off tomorrow. Signing closes the door on phishing in the meantime.

Office has a setting that most people never use: disable all macros except those digitally signed by a trusted publisher. With that policy in place, a macro runs only when it carries a valid signature from a certificate your devices already trust. There is no yellow bar and no “Enable Content” button. A phishing document is not signed by your organisation, so it cannot run, whatever its story and whoever opens it.

That turns the problem around. Instead of hoping every person makes the right call every time, you decide once, centrally, which macros may run. Everything else is blocked by the software, not by vigilance.

  • Phishing macros never run

    An attacker would need your organisation’s private signing key. A document from outside is simply refused.

  • You get an inventory

    Every macro that runs in your organisation has been uploaded, analysed and signed on purpose. The audit log tells you what was signed, by whom and when. Unknown macros stop being a mystery.

  • Checked before it is trusted

    Each file is analysed before signing. A macro that runs automatically and writes files or starts programs is held back unless an administrator allow-lists that exact project.

  • A built-in sunset

    Signatures belong to certificates, and certificates expire. As you replace each workbook, you stop re-signing it. The estate shrinks on a timetable you control, and nothing new slips in while it does.

Microsoft is phasing macros out. Signing is how you keep up.

  1. 2022Office began blocking VBA macros in files downloaded from the internet by default, across Word, Excel, PowerPoint, Access and Visio, and turned off Excel 4.0 macros by default.
  2. 2023Microsoft announced the deprecation of VBScript, the scripting language behind many old automation tricks.
  3. NowThe supported way to keep a business-critical macro running under tight policies is a digital signature from a publisher your devices trust. Office Scripts, Power Automate, add-ins and Python in Excel are the destinations for the work macros used to do.

Macro Signing is the bridge, not the destination. Sign what you must keep, block everything else, and retire each macro as you replace it. Our rollout guide covers the Intune and Office policies that make the “signed only” setting stick.

Our first product

Macro Signing

Your own certificate authority, a check before every signature, and a signed file back in under a minute.

Setting Office to run only signed macros needs two things most organisations do not have: a certificate authority of their own, and a careful, repeatable way to sign each file. Macro Signing gives you both, run by a small Australian company.

It is built for the ACSC Essential Eight strategy Restrict Microsoft Office macros: the section below maps each control the assessor checks to what Macro Signing provides, what you configure, and what it does not do.

How it works

  1. We set up your organisation

    We create your organisation with its own root certificate authority and signing certificate. You deploy the root certificate, the signing certificate (as a trusted publisher) and the “Disable all except digitally signed macros” policy with Microsoft Intune or the Office cloud policy service, following our rollout guide and its downloadable bundle of Intune and Group Policy templates.

  2. Every file is checked first

    Before anything is signed, each Office file is analysed with olevba and mraptor. A macro that runs automatically and writes files or starts programs is blocked, unless an administrator allow-lists that exact VBA project.

  3. Signed, timestamped, verified

    The macro is signed in all three Office VBA signature formats, with an RFC 3161 timestamp from DigiCert. Our server independently verifies every signature before the signed file comes back to you.

What keeps it safe

  • Your own root

    Each organisation has its own root certificate authority and an RSA 4096 signing certificate. Your devices trust your root, and nobody else’s files are signed with your certificate.

  • Keys held securely

    Your private keys are generated and stored in secure, access-controlled key storage.

  • Checked before, verified after

    Static analysis runs before a file is signed, and the server checks the finished signature and timestamp before you get the file back.

  • Accountable access

    Staff sign in with Microsoft (Entra ID), or with a local account that requires multi-factor authentication. Roles and permissions decide who can do what, and an audit log records it.

  • Fits your pipeline

    An API lets CI pipelines and ServiceNow send files for signing, through the same checks. Customers find the API reference in the dashboard.

  • Kept in Australia

    Your files and keys stay in Australia.

Essential Eight

Where it fits in the Essential Eight

The ACSC strategy is Restrict Microsoft Office macros. Here is each control from the ACSC’s assessment process guide, and who does what.

The assessment process guide tells assessors what to look for at each maturity level: which Office policies must be set, what screenshots to ask for, and how a digitally signed approach should be run. Macro Signing is one piece of that strategy. It gives your organisation its own code-signing certificate authority, checks each macro before signing it, signs in the V3 format the guide requires, and records every signing. The Office policies on your devices are yours to set, and our rollout bundle carries each setting the guide names, for Intune and for Group Policy. Antivirus scanning, attack-surface-reduction rules and event logging live in Microsoft Defender and your logging platform, not here.

The guide’s own advice at Maturity Level Three: an organisation should ideally acquire its own code-signing certificate and re-sign any macros it trusts using V3 signatures, even if they were already signed by a third party, so that a vendor’s compromised certificate never becomes your problem. That is exactly what Macro Signing does.

Control by control

Maturity Level One4 controls

Macros are disabled for users that do not have a demonstrated business requirement
Macro Signing
The audit log shows who signs and what they signed, evidence for the approvals record.
You configure
Two groups of users: everyone else gets “Disable all macros without notification”; the approved group gets “Disable all macros except digitally signed macros”. Both policies are in the rollout bundle. The approvals record is yours.
Macros in files originating from the internet are blocked
You configure
“Block macros from running in Office files from the Internet”, plus the Windows setting that stops users removing the Mark of the Web. Both in the bundle.
Macro antivirus scanning is enabled
You configure
“Macro Runtime Scan Scope” set to all files. In the bundle.
Outside Macro Signing
The scanning itself is Microsoft Defender or your antivirus through the Antimalware Scan Interface.
Macro security settings cannot be changed by users
You configure
Policy-managed settings appear greyed out in the Trust Center. The bundle sets them by policy; the guide checks for that.

Maturity Level Two2 controls

Macros are blocked from making Win32 API calls
Outside Macro Signing
A Microsoft Defender attack-surface-reduction rule, set in Intune or Group Policy.
Allowed and blocked macro execution events are centrally logged
Macro Signing
Every signing is recorded with who, when, the file hash, the scan verdict and the timestamp, and the audit trail can be exported.
Outside Macro Signing
Macro execution events on devices come from Office and Defender into your log platform.

Maturity Level Three5 controls

Only macros running from within a sandboxed environment, a Trusted Location or that are digitally signed by a trusted publisher are allowed to execute
Macro Signing
Your own certificate authority and signing certificate, issued only to your organisation.
You configure
“Disable all macros except digitally signed macros”, your root as a trusted root, your signing certificate as a trusted publisher, and Trusted Locations disabled. All in the bundle.
Macros are checked to ensure they are free of malicious code before being digitally signed
Macro Signing
Every file is analysed with olevba and mraptor before signing. A macro that runs automatically and writes files or starts programs is held back unless an administrator allow-lists that exact project. The verdict is stored with the signing.
You configure
Your own review of a held-back macro before you allow-list it.
Outside Macro Signing
Static analysis lowers the risk; it cannot prove a macro is harmless.
Macros digitally signed by an untrusted publisher cannot be enabled via the Message Bar or Backstage View
You configure
“Disable all Trust Bar notifications for security issues” and the “Disable commands” setting for the Backstage button, both in the bundle.
Macros digitally signed by signatures other than V3 signatures cannot be enabled
Macro Signing
Every macro is signed in the V3 format, and in the two older formats for older Office builds.
You configure
“Only trust VBA macros that use V3 signatures”. In the bundle.
The list of trusted publishers is validated on an annual or more frequent basis
Macro Signing
One publisher, yours. The Certificates page shows its thumbprint and expiry; certificates last five years and are rotated from there.
You configure
The annual check, which with one publisher is a glance at the Trusted Publishers page.

Control wording from the ACSC Essential Eight assessment process guide, October 2024 edition. Our rollout guide names the policy path and registry value for each setting and includes a script that reports them from a device.

What you can hand an assessor

  • The signing record

    For every macro: who signed it, when, the file hash, the scan verdict, the signature formats and the RFC 3161 timestamp. Exportable from the dashboard.

  • The trusted publisher

    Your signing certificate’s thumbprint, issuer and expiry, and the root it chains to, from the Certificates page and in the rollout bundle.

  • The device settings

    The guide asks for screenshots of Macro Settings and Trusted Publishers in the Trust Center and an RSoP report. The bundle’s verification script prints the effective setting from each policy source.

See the walkthrough

Pricing

Pay per macro. Once.

No subscription and no seat fees. Buy macros when you need them.

A$25 per macro, paid once by card

One macro covers
every macro in one file’s VBA project
Re-signing a macro you have signed before
A$5
Packs
10, 25, 50 or 100, or any number up to 500
Signing credit
never expires; every charge shows on your balance
New organisations
10 free macros
Scans
free, as many as you like
Signing certificates last
5 years
Subscription or seat fees
None

Implementation service

Want us to run the rollout?

An engagement with your IT team: inventory the macros your organisation still depends on, design the approved-user group and the policies, deploy the root certificate, trusted publisher and macro settings through Intune or Group Policy, run a pilot, cut over, and leave you with the evidence pack an Essential Eight assessor asks for.

A quote will be provided after a short conversation about your fleet and your macros.

Ask about implementation How a rollout goes

Who it’s for

Organisations moving off macros, carefully

For teams that still depend on a handful of macros while they migrate away from them.

  • Government agencies

    Keep the few macro-enabled workbooks that still matter working while every other macro is blocked.

  • Defence industry suppliers

    Decide centrally which macros can run, using a signing certificate issued only to your organisation, instead of leaving the call to each user.

  • Managed service providers

    Each organisation you look after is set up separately, with its own root and signing certificate.

  • Regulated businesses

    Every file is checked before it is signed, and the audit log records who did what.

How we work

Plain dealing

Macro Signing is our first product. More practical Essential Eight tools will follow, built the same way.

  • You pay once and own what you paid for.

    The macros you buy are yours to use when you need them, and they don’t expire. Nothing is charged by the month or by the seat.

  • No subscriptions for things you aren’t using.

    If you sign three macros this year, you pay for three macros.

  • Honest answers in plain English.

    If our tool isn’t the right fit for your problem, we’ll tell you.

  • Real customer service.

    Email us and a person who knows the product will reply, during Australian business hours.

Contact

Talk to us

We set up each new organisation ourselves, so there is no sign-up form. Email us about your organisation and the macros you need to keep, and we’ll take it from there. If you would like us to run the rollout for you, say so and we will come back with a quote. There’s no need to attach any files yet.

KeyWright Security · ABN 59 413 475 217 · Victoria, Australia

Email us Existing customer? Sign in