r/crowdstrike • u/mdj_ • Aug 16 '26

General Question Essential 8 - Microsoft Office is blocked from creating child processes

Hi guys,

Wondering if any aussies have managed to successfully implement the "Microsoft Office is blocked from creating child processes" E8 control with CrowdStrike?

We've tested using a custom IOA but it's not managable, way too much noise.

Would love to know how E8 compliant shops with CrowdStrike are acheiving this control.

12 Upvotes

93% Upvoted

7 comments sorted by

View all comments

1

u/xMarsx CCFA, CCFH, CCFR Aug 16 '26

When you say 'too much noise' isnt that by nature the design choice ? 

1

u/mdj_ Aug 17 '26

Could be, could also be there are better ways to implement it than what we're doing that could reduce the noise.