From 965b3d28632c75888cb7afd05b5a5acc7d40bb64 Mon Sep 17 00:00:00 2001
From: 87owo <85057800+87owo@users.noreply.github.com>
Date: Tue, 7 Jul 2026 02:56:36 +0800
Subject: [PATCH] Add files via upload

---
 Plugins/Rules/Rules_Driver_P1.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Plugins/Rules/Rules_Driver_P1.json b/Plugins/Rules/Rules_Driver_P1.json
index 20a38e1..93c9d5f 100644
--- a/Plugins/Rules/Rules_Driver_P1.json
+++ b/Plugins/Rules/Rules_Driver_P1.json
@@ -42,6 +42,7 @@
             "Category": "Process",
             "InitiatorExclude": [
                 "*\\PYAS.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\PYAS_Setup.tmp",
                 "\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
@@ -60,7 +61,6 @@
                 "Terminate",
                 "SuspendResume",
                 "DuplicateHandle",
-                "SetInformation",
                 "CreateProcess",
                 "SetThreadToken",
                 "Impersonate",
@@ -88,6 +88,7 @@
             "Category": "Memory",
             "InitiatorExclude": [
                 "*\\PYAS.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\PYAS_Setup.tmp",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
             ],