ExploitGuardBlockOfficeChildProcess (2)

id: 6df0dd4f-5572-4ab9-bde7-1f322547bff7
name: ExploitGuardBlockOfficeChildProcess (2)
description: |
  These queries check telemetry from the Exploit Guard rule: Rule: Block Office applications from creating child processes.
  (Rule ID d4f940ab-401b-4efc-aadc-ad5f3c50688a).
  Read more about it here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.
  Oftentimes organizations enable this rule in audit mode and check the results before setting block mode.
  You can use query #2 to measure the rule impact on your network in audit mode before turning it to block mode.
  Query #1 is used after setting it to block mode - to analyze the block stats.
  Tags: #ASR.
  Query #1: block stats.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
query: |2-

  // These queries check telemetry from the Exploit Guard rule: Rule: Block Office applications from creating child processes - MTP Schema
  // (Rule ID d4f940ab-401b-4efc-aadc-ad5f3c50688a)
  // Read more about it here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard
  // Oftentimes organizations enable this rule in audit mode and check the results before setting block mode.
  // You can use query #2 to measure the rule impact on your network in audit mode before turning it to block mode.
  // Query #1 is used after setting it to block mode - to analyze the block stats.
  // Tags: #ASR
  //Query #1: block stats
  DeviceEvents
  | where ActionType == "AsrOfficeChildProcessBlocked" and Timestamp > ago(7d)
  | project BlockedProcess=FileName, ParentProcess=InitiatingProcessFileName, DeviceName
  | summarize MachineCount=dcount(DeviceName), RuleHits=count() by BlockedProcess, ParentProcess
  | sort by MachineCount desc