Recommended route to fix this is the Attack Surface Reduction Rule Block all Office applications from creating child processes<\/a> <\/p>\n\n\n\n Deploying this through Intune is Simple , but what about servers? Remember Intune only works with Windows Devices<\/p>\n\n\n\n ASR rules actually work for Servers IF<\/strong> they have been onboarded into Defender<\/p>\n\n\n\n Make sure the ASR policy Targets MicrosoftSense<\/p>\n\n\n\n Onboarded in MDE is MicrosoftSense<\/p>\n\n\n\n MDM is Intune<\/p>\n\n\n\n Items that work on MDR in ASR Attack surface reduction rules reference | Microsoft Learn<\/a><\/p>\n\n\n\n![\"\"](\"https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2023\/07\/image-2-1024x243.png\")
<\/a><\/figure>\n\n\n\n