• AV usually runs as a filter driver in the IO stack, not an injection in process.

    Always exclude.