Attack surface reduction - check trigger if possible

Hello, I configured ASR rules and now reviewing exceptions. Is it possible to find out what triggers "sc.exe" or "conhost.exe" without checking event viewer on the specific machine? Or we can just ...