Certified Ethical Hacker (CEH) Practice Question

The ASR rule that blocks all Office applications from creating child processes stops Word, Excel, or other Office applications from launching cmd.exe, PowerShell, or script interpreters. This directly disrupts the technique Emotet uses to spawn a PowerShell downloader while still allowing signed or trusted macros that do not need to create external processes.

The rule that blocks executable content from email clients only prevents the direct execution of EXE or script attachments and would not stop a macro inside a document from spawning PowerShell. Controlled folder access protects user data from encryption but does not address the initial execution path. Enabling cloud-delivered protection improves signature and ML detection but does not specifically prevent Office from spawning child processes, so the macro could still fire.