Create exclusion for a child?

[WebGreg 1]

Hi.

The important data that allows me to accurately determine the exclusion is contained in cmd. From what I see, I can only set an exclusion for the psexesvc.exe process and for the parent and processes higher in the tree. Is there any way to refer to the following? I would like to set an exclusion where if a cmd.exe is created from the psexesvc.exe process by a specific user - then ignore it.