Windows Firewall: wuauserv-specific outbound rule does not allow Windows Update traffic

I am configuring Windows 11 Defender Firewall with the Domain profile set to Default Outbound = Block, then explicitly allowing required applications and services.

I have encountered a reproducible problem with Windows Update / Microsoft Defender security intelligence updates.

Intended rule

I created an outbound rule with:

• Program: C:\Windows\System32\svchost.exe
• Service: wuauserv
• Protocol: TCP
• Remote port: 80
• Remote address: Any
• Profile: Domain
• Action: Allow

The rule is enabled and I have verified its application, service, port and address filters with PowerShell.

wuauserv reports:

SERVICE_SID_TYPE: UNRESTRICTED

and runs as:

C:\WINDOWS\system32\svchost.exe -k netsvcs -p

What happens

With the service-qualified rule above, Update-MpSignature fails with:

0x8024402f

I enabled Windows Filtering Platform failure auditing.

Event ID 5157 recorded the failed connection as:

• Application: \device\harddiskvolume6\windows\system32\svchost.exe
• Direction: Outbound
• Destination port: 80
• Filter origin: Default Outbound

I then correlated the PID in the WFP event with Win32_Service.

The PID was confirmed to be running:

wuauserv — Windows Update

So Windows Firewall blocked an outbound TCP/80 connection from an svchost.exe PID which was confirmed to be hosting wuauserv, despite an enabled Allow rule specifically for:

svchost.exe + wuauserv + TCP/80

A/B test

I added a temporary rule with the service restriction removed:

• Program: C:\Windows\System32\svchost.exe
• Protocol: TCP
• Remote port: 80
• Profile: Domain
• Action: Allow

Update-MpSignature then succeeded immediately.

The Defender security intelligence version advanced from:

1.457.409.0

to:

1.457.413.0

Therefore, on this machine:

svchost.exe + Service=wuauserv + TCP/80  -> blocked

but:

svchost.exe + TCP/80                    -> works

The second rule is undesirable because it potentially permits any service hosted by the genuine svchost.exe to initiate outbound TCP/80 connections.

Question

Why does Windows Filtering Platform not match this connection against the Allow rule scoped to wuauserv, even though the PID reported by WFP is confirmed to host the wuauserv service?

Is there a supported way on current Windows 11 to permit the required Windows Update / Defender update traffic while retaining both:

1. Default Outbound = Block, and
2. an outbound permission restricted specifically to wuauserv, rather than allowing all svchost.exe processes outbound TCP/80?

I am specifically trying to avoid a permanent generic:

svchost.exe -> TCP/80 -> Any

exception.