Application Controol "Launch process" triggers on office files

Hi

Just experienced a strange issue.

I have created a “Launch process” rule in application control that should block launching processes from “my documents” folder for the end users. The strange thing is that the logs sometimes show that SEP blocks create processes on .pdf, xls and .doc files laying in my documents.

The caller processes is then iexplorer.exe (Internet explorer). How come IE trigger launch statement on these files?

Shouldn’t saving a office file trigger a write action, reading a read action and launching just trigger when opening applications? I could understand if Iexplorer.exe launched an executable in my documents, but office files?

Are there any documents describing what “launch process” really means? I thought this only was .exe files, but looks like it use some other logic.

Using 12.1.4

Best Regards

Torb