Forum Discussion
ASR Rule - Block Win32 API Calls from Office Macro
What does this ASR rule really do ? This question because we see that not only Win32 API Calls are blocked but also x64. During tests, we used an Excel 64-bit with VBA-code. First test was VBA-c...
'Win32 API Calls' actually refers to just Windows API calls, no matter if 32 or 64 bits.
This ASR rule blocks some API calls, MS does not tell which.
We were able to identify macros calling APIs by looking for code like 'Declare*Function * lib ' and treat them as potencially being blocked in the future.
Putting the macros in a trusted folder or digitally signing them allows Excel to open the files, but any work done can't be saved as it triggers the rule again, even if the VBA code was not modified. (Apparently the temp file created by excel during save is blocked by the rule)