Appearance
Microsoft Word
Validate Microsoft Word behaviors under the Secure Sandbox.
Objectives
- Enforce network controls for external links and embedded objects.
- Verify file system isolation for Open/Save operations.
- Prevent data exfiltration via clipboard, drag-drop, and printing.
- Ensure Protected View does not conflict with Turbo isolation.
- Verify printing controls.
- Verify macro execution isolation.
Preconditions
- Windows target with Turbo Launcher and Secure Sandbox.
- Microsoft Word installed.
- Printer restrictions configured if applicable.
Controls Under Test
runtime.networking.egressDefaultAction.runtime.files.contextsand isolation overlays.runtime.dataMotion.rules[]withchannel: "clipboard"|"dragDrop"|"screenCapture".device.type: "printer"controls.- Process isolation settings (macros).
- External processor controls (MAPI/email share) when applicable.
Test Scenarios
| ID | Canonical ID | Scenario | Procedure | Expected Outcome |
|---|---|---|---|---|
| SCEN-APP-MICROSOFT-WORD-01 | NET-EGRESS-01 | External Link | Click a hyperlink (http/https) inside a doc. | Browser launches; if browser is in sandbox, request subject to proxy. If sent to host browser, blocked by association policy. |
| SCEN-APP-MICROSOFT-WORD-02 | HARD-HOST-03 | Protected View | Open a downloaded file (Zone.Identifier present). | App opens in Protected View (if configured); Turbo isolation still holds. |
| SCEN-APP-MICROSOFT-WORD-03 | HARD-FILES-01 | Save to Host | Attempt Save As to Host Desktop. | Writes restricted to overlay or allowed Storage Contexts. |
| SCEN-APP-MICROSOFT-WORD-04 | DM-DEVICE-01 | Print Restriction | File > Print. | Printers enumerated per policy; restricted if device control enabled. |
| SCEN-APP-MICROSOFT-WORD-05 | HARD-PROCESS-04 | Macro Execution | Open doc with macros; enable content. | Macros run within sandbox; cannot spawn processes outside sandbox. |
| SCEN-APP-MICROSOFT-WORD-06 | DM-CLIP-01 | Clipboard Outbound | Copy text; paste to host. | Denied/processed per policy. |
| SCEN-APP-MICROSOFT-WORD-07 | DM-DRAG-01 | Drag-Drop Outbound | Drag text/file to host. | Blocked per policy. |
| SCEN-APP-MICROSOFT-WORD-08 | NET-EGRESS-01 | Remote template (HTTP/S) | File > Info > Templates: attach a template via https://.... | Denied; audit shows outbound attempt; no template load. |
| SCEN-APP-MICROSOFT-WORD-09 | NET-EGRESS-01 | Normal.dotm from UNC/URL | Force Word to load Normal.dotm from \\server\\share or https://.... | Denied; audit shows SMB/HTTP deny; fallback to local default. |
| SCEN-APP-MICROSOFT-WORD-10 | NET-EGRESS-01 | Linked images/fields | Insert > Online Pictures or INCLUDEPICTURE with URL; update field. | Denied; image/field cannot fetch; audit network event. |
| SCEN-APP-MICROSOFT-WORD-11 | NET-EGRESS-01 | Mail Merge external source | Start Mail Merge; Select Recipients from HTTP/UNC/SQL (ODBC). | Denied at network boundary; or restricted to Storage Contexts only. |
| SCEN-APP-MICROSOFT-WORD-12 | NET-EGRESS-01 | Office Add-ins Store | Insert > Get Add-ins; install a sample add-in. | Requests traverse enforced proxy; denied if catalog not allowlisted. |
| SCEN-APP-MICROSOFT-WORD-13 | HARD-PROCESS-04 | DDEAUTO to shell | Create a DDE field that launches cmd.exe or powershell.exe. | Blocked; no process spawn. |
| SCEN-APP-MICROSOFT-WORD-14 | HARD-PROCESS-04 | VBA network exfil | Macro using MSXML2.XMLHTTP/WinHttpRequest/ADODB.Stream to POST file contents. | Denied at egress boundary; no child process escape. |
| SCEN-APP-MICROSOFT-WORD-15 | DM-PROCEXT-03 | Share via Email (MAPI) | File > Share > Email; attempt to open host Outlook compose. | Denied per external processor policy or routed to sandboxed mail client; audit shows processor deny/failure when applicable. |
| SCEN-APP-MICROSOFT-WORD-16 | DM-DRAG-01 | Drag OLE package/object to host | Embed a file; drag object to Host Desktop. | Blocked; audit dataMotion dragDrop. |
| SCEN-APP-MICROSOFT-WORD-17 | HARD-FILES-01 | OLE package Save As | Open embedded object > Save As to host path. | Denied or virtualized to overlay/context. |
| SCEN-APP-MICROSOFT-WORD-18 | DM-CLIP-01 | Clipboard: formatted content | Copy pages with images/objects; paste on host. | Denied/processed per policy (size/format caps). |
| SCEN-APP-MICROSOFT-WORD-19 | DM-SCREEN-01 | Insert Screenshot (host window) | Insert > Screenshot; capture external window. | Block/obfuscate or watermark; audit screenCapture. |
| SCEN-APP-MICROSOFT-WORD-20 | DM-DEVICE-01 | Print to PDF/XPS | File > Print > Microsoft Print to PDF/XPS; save to Host Desktop. | Writes restricted to overlay/context; device audit present. |
| SCEN-APP-MICROSOFT-WORD-21 | NET-EGRESS-01 | Smart Lookup/Researcher/Translate | Right-click text; use Smart Lookup or Translate. | Denied unless allowlisted; audit shows deny. |
| SCEN-APP-MICROSOFT-WORD-22 | NET-EGRESS-01 | OneDrive/SharePoint AutoSave | Toggle AutoSave on; sign in; save to cloud. | Denied; no cloud sync; fail-closed, proxy enforced. |
| SCEN-APP-MICROSOFT-WORD-23 | NET-EGRESS-01 | Hyperlinks to file:// or UNC | Click links like file://C:/... or \\\\server\\share\\.... | Access blocked or constrained to Storage Contexts; SMB egress denied. |
| SCEN-APP-MICROSOFT-WORD-24 | HARD-FILES-01 | Save As to UNC path | Attempt to save directly to \\\\server\\share. | Denied or redirected to overlay/context. |
Evidence Requirements
networkevents:protocol/alpn,destination/sni(when applicable),ipVersion,action,outcome,proxyEnforced, andreason(for example,unauthorizedProxy,proxyUnavailable,certMismatch,pinningFailed).fileOpevents: write attempts to host paths; includepath,action/outcome(deny/virtualized), and context identifiers.dataMotionevents:channel(clipboard|dragDrop|screenCapture),direction(for clipboard),action,outcome,rule.id,priority.deviceevents: print attempts, virtual printer usage.processevents: child process creation attempts (for example, from DDE/VBA), including process image and outcome.externalProcessorevents: attempts to hand off to email/MAPI, including outcome.
Troubleshooting
- Protected View may suppress some actions until you select Enable Editing/Enable Content; perform tests after enabling when required by the scenario.
- Some enterprise builds hide cloud features (OneDrive/SharePoint/Smart Lookup/Translate) via policy. When hidden, mark those as not applicable and focus on analogous link/update flows.
- Add-ins can vary; test a representative free add-in to exercise marketplace/proxy enforcement.
Known Limitations & Negative Space
- Optical capture (camera/phone) is out of scope.
- If Word is federated with enterprise sign-in, authentication prompts might appear but network egress should still fail-closed without allowlisting.
- SMB/UNC scenarios model outbound access; internal, policy-mapped Storage Contexts remain in scope and may be allowed by configuration.