diff --git a/1_process_creation/exclude_svchost.xml b/1_process_creation/exclude_svchost.xml
index 9e872245..7644fede 100644
--- a/1_process_creation/exclude_svchost.xml
+++ b/1_process_creation/exclude_svchost.xml
@@ -66,6 +66,7 @@
 				<CommandLine condition="is">C:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvc</CommandLine>				<!--Microsoft:Windows:Apps: AppX Deployment Service-->
 				<CommandLine condition="is">C:\Windows\system32\svchost.exe -k wsappx -s ClipSVC</CommandLine>				<!--Microsoft:Windows:Apps: Client License Service-->
 				<CommandLine condition="is">C:\Windows\system32\svchost.exe -k wsappx</CommandLine>				<!--Microsoft:Windows:Apps [ https://www.howtogeek.com/320261/what-is-wsappx-and-why-is-it-running-on-my-pc/ ] -->
+				<CommandLine condition="is">C:\Windows\system32\svchost.exe -k wusvcs -p</CommandLine>				<!---Microsoft:Windows Update Medic Service -->
 				<ParentCommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs</ParentCommandLine>				<!--Microsoft:Windows: Network services: Spawns Consent.exe-->
 				<ParentCommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted</ParentCommandLine>				<!--Microsoft:Windows-->
 			</ProcessCreate>