From 9e69dac4e0a3dd0365aa9b1f5ae99aaf3c3c417f Mon Sep 17 00:00:00 2001
From: 87owo <85057800+87owo@users.noreply.github.com>
Date: Tue, 7 Jul 2026 22:35:31 +0800
Subject: [PATCH] Add files via upload

---
 Plugins/Rules/Rules_Driver_P1.json | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/Plugins/Rules/Rules_Driver_P1.json b/Plugins/Rules/Rules_Driver_P1.json
index 368075c..d9e96ef 100644
--- a/Plugins/Rules/Rules_Driver_P1.json
+++ b/Plugins/Rules/Rules_Driver_P1.json
@@ -120,7 +120,7 @@
         {
             "Name": "File_Protect_System",
             "Code": 2002,
-            "Kill": false,
+            "Kill": true,
             "Category": "File",
             "InitiatorExclude": [
                 "*\\PYAS.exe",
@@ -140,14 +140,6 @@
                 "\\Device\\HarddiskVolume*\\EFI\\*",
                 "\\Device\\HarddiskVolume*\\Boot\\*",
                 "\\Device\\HarddiskVolume*\\Recovery\\*",
-                "\\Device\\HarddiskVolume*\\System Volume Information\\*",
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\config\\*",
-            ],
-            "TargetExclude": [
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\*",
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\*",
-                "\\Device\\HarddiskVolume*\\System Volume Information\\SystemRestore\\FRStaging",
-                "\\Device\\HarddiskVolume*\\System Volume Information\\IndexerVolumeGuid",
             ],
             "Operations": [
                 "Write",