From a2b66aec64871ce3b4daac8a8404fff3757a7c71 Mon Sep 17 00:00:00 2001
From: 87owo <85057800+87owo@users.noreply.github.com>
Date: Fri, 14 Aug 2026 12:43:24 +0800
Subject: [PATCH] Add files via upload

---
 Plugins/Rules/Rules_Driver_P1.json | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Plugins/Rules/Rules_Driver_P1.json b/Plugins/Rules/Rules_Driver_P1.json
index 0cf807d..68662f9 100644
--- a/Plugins/Rules/Rules_Driver_P1.json
+++ b/Plugins/Rules/Rules_Driver_P1.json
@@ -65,6 +65,7 @@
                 "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\_unins.tmp",
                 "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\sogoupdf\\pdfpopcl.exe",
                 "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\WeGame\\*\\tiny_dl\\TinyDL.exe",
+                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
@@ -251,6 +252,7 @@
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\TrustedInstaller.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*\\TiWorker.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\UUS\\amd64\\wuaucltcore.exe",
                 "\\Device\\HarddiskVolume*\\$WinREAgent\\Scratch\\*\\DismHost.exe",
             ],
             "Target": [
@@ -461,6 +463,7 @@
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\vds.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\format.com",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\WinSAT.exe",
             ],
             "Operations": [
                 "Ioctl",