Threat actors have adapted their initial access techniques following Microsoft's 2022 decision to block macros in Office documents downloaded from the Internet, shifting to disk image files (ISO, IMG, VHD, VHDX) and malicious OneNote files. This post provides ready-to-use PowerShell one-liners that Windows administrators can run to harden endpoints against these attack vectors: disabling embedded file execution in OneNote, blocking automatic mounting of disk image files, and enforcing macro blocking for Office applications downloaded from the Internet — all via direct Windows Registry modifications without needing GPO templates.
