HIPS - explorer.exe is trying to execute <program mane>

I am using CIS 6.0 in Proactive Security setting. I changed the FW to custom and D+ to safe. These are the only options I changed, The rest iis left to default. I only installed FW with D+; no AV component.

I got HIPS alert that explorer.exe is triyng to execute soffice.exe. It said that explorer.exe was a safe program, but soffice.exe was unrecognized. I clicked allow and remember. Where is this saved so I can delete it; so the I get the alert again. I trust soffice, but was thinking if I accidentally do this for a program I don’t trust. I want to be able to revoke the permission. Please help.

tasks->advanced tasks->advanced settings->defense±>Hips rules

then delete the rule that got created

There are no new rules listed…it is the same default rules that were there before. By the way, there are no programs listed under “All Programs” section, should there be?

the only thing under my all programs rule is * so it looks like this will watch all applications.

try going into the same place as i said before but double click on the rule “%windir%\explorer.exe” then click modify in the run an executable row and that will list all the things explorer is allowed to execute

[attachment deleted by admin]