From 4904c670bb8f4f1dae993642d12a6d4e1d321289 Mon Sep 17 00:00:00 2001
From: Giorgi Mkervalishvili <giomke@users.noreply.github.com>
Date: Wed, 12 Jul 2023 20:26:52 +0400
Subject: [PATCH] Update exclude_svchost.xml

Add wusvcs Windows Update Medic Service
---
 1_process_creation/exclude_svchost.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/1_process_creation/exclude_svchost.xml b/1_process_creation/exclude_svchost.xml
index 9e872245..7644fede 100644
--- a/1_process_creation/exclude_svchost.xml
+++ b/1_process_creation/exclude_svchost.xml
@@ -66,6 +66,7 @@
 				<CommandLine condition="is">C:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvc</CommandLine>				<!--Microsoft:Windows:Apps: AppX Deployment Service-->
 				<CommandLine condition="is">C:\Windows\system32\svchost.exe -k wsappx -s ClipSVC</CommandLine>				<!--Microsoft:Windows:Apps: Client License Service-->
 				<CommandLine condition="is">C:\Windows\system32\svchost.exe -k wsappx</CommandLine>				<!--Microsoft:Windows:Apps [ https://www.howtogeek.com/320261/what-is-wsappx-and-why-is-it-running-on-my-pc/ ] -->
+				<CommandLine condition="is">C:\Windows\system32\svchost.exe -k wusvcs -p</CommandLine>				<!---Microsoft:Windows Update Medic Service -->
 				<ParentCommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs</ParentCommandLine>				<!--Microsoft:Windows: Network services: Spawns Consent.exe-->
 				<ParentCommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted</ParentCommandLine>				<!--Microsoft:Windows-->
 			</ProcessCreate>