I am tightening our ASR rules to block child processes and executable processes from being created. I have a list of exclusions, but they don't seem to be working. See attached images of how it's configured and what is detected.
What am I doing wrong here?
