EAF violation blocked by exploit protection on one endpoint

Hi What will be the possible scenario where ntdll.dll was blocked by Exploit Mitigation using rule "accessing the Export Address Table for module" on a powerpoint