Thank you for posting in community forum. Looking at the event I see the source process here is ‘System:Remote’, and by design exclusions can be created for Access Protection only using source process.
As mentioned in KB68560 , creating exclusion for source process SYSTEM:REMOTE is as good as disabling rule.
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.