attack_surface_monitor Monitor common attack surface processes (Microsoft Word for macros, web browsers etc) for suspicious child processes which indicate potential exploitation