ExploitGuardBlockOfficeChildProcess

id: 835e8f87-f387-4ee5-ab79-d03b5e5e816b
name: ExploitGuardBlockOfficeChildProcess
description: |
  These queries check telemetry from the Exploit Guard rule: Rule: Block Office applications from creating child processes.
  (Rule ID d4f940ab-401b-4efc-aadc-ad5f3c50688a).
  Read more about it here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.
  Oftentimes organizations enable this rule in audit mode and check the results before setting block mode.
  You can use query #2 to measure the rule impact on your network in audit mode before turning it to block mode.
  Query #1 is used after setting it to block mode - to analyze the block stats.
  Tags: #ASR.
  Query #1: block stats.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
query: |
  DeviceEvents
  | where ActionType == "AsrOfficeChildProcessBlocked" and Timestamp > ago(7d)
  | project BlockedProcess=FileName, ParentProcess=InitiatingProcessFileName, DeviceName
  | summarize MachineCount=dcount(DeviceName), RuleHits=count() by BlockedProcess, ParentProcess
  | sort by MachineCount desc