ExploitGuardBlockOfficeChildProcess (1)

These queries check telemetry from the Exploit Guard rule: Rule: Block Office applications from creating child processes. (Rule ID d4f940ab-401b-4efc-aadc-ad5f3c50688a). Read more about it here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard. Oftentimes organizations enable this rule in audit mode and check the results before setting block mode. You can use query #2 to measure the rule impact on your network in audit mode before turning it to block mode. Query #1 is used after setting it to block mode - to analyze the block stats. Tags: #ASR. Query #1: block stats.