From 81bebeda63d233f3e657510684bfadb09d5a01f0 Mon Sep 17 00:00:00 2001
From: 87owo <85057800+87owo@users.noreply.github.com>
Date: Sat, 25 Jul 2026 00:08:11 +0800
Subject: [PATCH] Add files via upload

---
 Plugins/Rules/Rules_Driver_P1.json | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/Plugins/Rules/Rules_Driver_P1.json b/Plugins/Rules/Rules_Driver_P1.json
index 2f96bed..5dfc89f 100644
--- a/Plugins/Rules/Rules_Driver_P1.json
+++ b/Plugins/Rules/Rules_Driver_P1.json
@@ -710,10 +710,24 @@
             "Operations": [
                 "Delete",
             ],
+            "InitiatorExclude": [
+                "*\\Windows\\servicing\\TrustedInstaller.exe",
+                "*\\Windows\\System32\\taskhostw.exe",
+                "*\\Windows\\System32\\svchost.exe",
+                "*\\Windows\\System32\\SearchIndexer.exe",
+                "*\\Windows\\System32\\spoolsv.exe",
+                "*\\Windows\\System32\\wbem\\WmiPrvSE.exe",
+                "*\\Windows\\WinSxS\\*\\TiWorker.exe",
+                "*\\Windows\\Microsoft.NET\\Framework64\\*\\ngen.exe",
+                "*\\PYAS.exe",
+            ],
             "Target": [
                 "\\REGISTRY\\MACHINE\\*",
                 "\\REGISTRY\\USER\\*",
             ],
+            "TargetExclude": [
+                "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\*"
+            ],
             "Threshold": 20,
             "TimeWindow": 3000,
         },