EAF violation blocked by exploit protection on one endpoint

[paulson2050]

Hi What will be the possible scenario where ntdll.dll was blocked by Exploit Mitigation using rule "accessing the Export Address Table for module" on a powerpoint