This behavior is due to ENS DLL orchestration. When a process runs, ATP scans the DLLs that it loads or are loaded in it. This action can result in a lowered process reputation and DAC containment of the process if DAC rules are triggered. For example, DAC might contain an otherwise trusted process like Excel.exe if it is injected with an unknown or lesser reputation DLL.