Adversaries may bypass Exploit Guard protections by creating malicious child processes from Office applications to execute payloads. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential evasion tactics and prevent lateral movement or data exfiltration.
KQL Query
// These queries check telemetry from the Exploit Guard rule: Rule: Block Office applications from creating child processes - MTP Schema
// (Rule ID d4f940ab-401b-4efc-aadc-ad5f3c50688a)
// Read more about it here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard
// Oftentimes organizations enable this rule in audit mode and check the results before setting block mode.
// You can use query #2 to measure the rule impact on your network in audit mode before turning it to block mode.
// Query #1 is used after setting it to block mode - to analyze the block stats.
// Tags: #ASR
//Query #1: block stats
DeviceEvents
| where ActionType == "AsrOfficeChildProcessBlocked" and Timestamp > ago(7d)
| project BlockedProcess=FileName, ParentProcess=InitiatingProcessFileName, DeviceName
| summarize MachineCount=dcount(DeviceName), RuleHits=count() by BlockedProcess, ParentProcess
| sort by MachineCount descid: 6df0dd4f-5572-4ab9-bde7-1f322547bff7
name: ExploitGuardBlockOfficeChildProcess (2)
description: |
These queries check telemetry from the Exploit Guard rule: Rule: Block Office applications from creating child processes.
(Rule ID d4f940ab-401b-4efc-aadc-ad5f3c50688a).
Read more about it here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.
Oftentimes organizations enable this rule in audit mode and check the results before setting block mode.
You can use query #2 to measure the rule impact on your network in audit mode before turning it to block mode.
Query #1 is used after setting it to block mode - to analyze the block stats.
Tags: #ASR.
Query #1: block stats.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- DeviceEvents
query: |2-
// These queries check telemetry from the Exploit Guard rule: Rule: Block Office applications from creating child processes - MTP Schema
// (Rule ID d4f940ab-401b-4efc-aadc-ad5f3c50688a)
// Read more about it here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard
// Oftentimes organizations enable this rule in audit mode and check the results before setting block mode.
// You can use query #2 to measure the rule impact on your network in audit mode before turning it to block mode.
// Query #1 is used after setting it to block mode - to analyze the block stats.
// Tags: #ASR
//Query #1: block stats
DeviceEvents
| where ActionType == "AsrOfficeChildProcessBlocked" and Timestamp > ago(7d)
| project BlockedProcess=FileName, ParentProcess=InitiatingProcessFileName, DeviceName
| summarize MachineCount=dcount(DeviceName), RuleHits=count() by BlockedProcess, ParentProcess
| sort by MachineCount desc
| Sentinel Table | Notes |
|---|---|
DeviceEvents | Ensure this data connector is enabled |
Scenario: Scheduled Job Running Microsoft Word Macro
Description: A legitimate scheduled job runs a macro in Microsoft Word to automate report generation.
Filter/Exclusion: process.name != "WINWORD.EXE" OR process.parent.name == "SCHEDULER.EXE"
Scenario: System Administrator Launching Excel for Data Analysis
Description: An admin uses Excel to analyze data, and the process is flagged as a child process of an Office application.
Filter/Exclusion: process.name != "EXCEL.EXE" OR process.parent.name == "explorer.exe" AND user.account == "Administrator"
Scenario: PowerShell Script Invoking Word to Generate Document
Description: A PowerShell script is used to automate document creation via Word, which is a common DevOps task.
Filter/Exclusion: process.name != "POWERSHELL.EXE" OR process.parent.name == "WINWORD.EXE" AND process.command_line LIKE "%-Command%"
Scenario: Microsoft Teams Running Word in Background
Description: Microsoft Teams runs Word in the background to edit documents shared in a chat.
Filter/Exclusion: process.name != "WINWORD.EXE" OR process.parent.name == "Teams.exe"
Scenario: Antivirus Scan Triggering Office Child Process
Description: A third-party antivirus tool uses Office applications to scan documents, triggering the rule.
Filter/Exclusion: process.name != "AV_SCAN.EXE" OR process.parent.name == "WINWORD.EXE" AND process.command_line LIKE "%scan%"