Excluding a script / process and its descendants from audit