diff --git a/Plugins/Rules/Rules_Driver_P1.json b/Plugins/Rules/Rules_Driver_P1.json
index 0cf807d..68662f9 100644
--- a/Plugins/Rules/Rules_Driver_P1.json
+++ b/Plugins/Rules/Rules_Driver_P1.json
@@ -65,6 +65,7 @@
                 "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\_unins.tmp",
                 "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\sogoupdf\\pdfpopcl.exe",
                 "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\WeGame\\*\\tiny_dl\\TinyDL.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
@@ -251,6 +252,7 @@
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\TrustedInstaller.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*\\TiWorker.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\UUS\\amd64\\wuaucltcore.exe",
                 "\\Device\\HarddiskVolume*\\$WinREAgent\\Scratch\\*\\DismHost.exe",
             ],
             "Target": [
@@ -461,6 +463,7 @@
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\vds.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\format.com",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\WinSAT.exe",
             ],
             "Operations": [
                 "Ioctl",