svchost keeps changing windows update files

I write security policies for a box using an IPS (Intrusion Prevention
System). This IPS prevents svchost.exe to modify files under system32
folder. But the problem is that MS keeps changing the Win update
program files from time to time and that raises alarms in my IPS. I do
not want to allow svchost.exe to write any random file under system32.

So this is what I came up with, I allow svchost.exe to modify

wuauclt.exe and cdm.dll

but seems like there is a complete slew of files that MS keeps updating
If anyone can give me the complete list of files that Windows Auto
Update requires then I could allow svchost to just modify those files.