diff --git a/Plugins/Rules/Rules_Driver_P1.json b/Plugins/Rules/Rules_Driver_P1.json
index eb1affb..fda3157 100644
--- a/Plugins/Rules/Rules_Driver_P1.json
+++ b/Plugins/Rules/Rules_Driver_P1.json
@@ -70,6 +70,7 @@
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\msiexec.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\SystemApps\\*\\SearchHost.exe",
                 "\\Device\\HarddiskVolume*\\Program Files\\*",
                 "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
@@ -810,36 +811,10 @@
             "Priority": 170,
         },
         {
-            "Name": "Registry_Protect_Pending_File_Rename",
+            "Name": "Registry_Protect_OOBE_Reset",
             "Code": 3006,
             "Kill": false,
             "Category": "Registry",
-            "InitiatorExclude": [
-                "\\Device\\HarddiskVolume*\\Windows\\*",
-                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
-                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
-                "*\\Sources\\SetupHost.exe",
-                "*\\Work\\*\\DismHost.exe",
-                "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
-                "*\\360Safe.exe",
-                "*\\PYAS.exe",
-            ],
-            "Target": [
-                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\PendingFileRenameOperations",
-                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\PendingFileRenameOperations2",
-            ],
-            "Operations": [
-                "Write",
-                "Delete",
-                "Create",
-            ],
-            "Priority": 140,
-        },
-        {
-            "Name": "Registry_Protect_OOBE_Reset",
-            "Code": 3007,
-            "Kill": true,
-            "Category": "Registry",
             "InitiatorExclude": [
                 "*\\Sources\\SetupHost.exe",
                 "*\\Work\\*\\DismHost.exe",