A security administrator wants to reduce the ways malware can compromise Windows devices by blocking risky behaviors such as Office applications creating executable content and scripts launching downloaded executables. Which Microsoft Defender for Endpoint capability is specifically designed to minimize these exploitable behaviors?