olafhartong-sysmon-modular/1_process_creation/exclude_adobe_flash.xml

<Sysmon schemaversion="4.30">
  <EventFiltering>
    <RuleGroup name="" groupRelation="or">
      <ProcessCreate onmatch="exclude">
        <Image condition="end with">C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe</Image>        <!--Adobe:Flash: Properly hardened updater, not a risk-->
      </ProcessCreate>
    </RuleGroup>
  </EventFiltering>
</Sysmon>