Spoof the parent process and block non-Microsoft DLLs

Reparenting a spawned process under explorer.exe and setting the block-non-Microsoft-DLL policy breaks EDR user-mode hooks and heuristics at once.