olafhartong-sysmon-modular/25_process_tampering/exclude_microsoft_edge.xml

<Sysmon schemaversion="4.50">
  <EventFiltering>
    <RuleGroup name="" groupRelation="or">
      <ProcessTampering onmatch="exclude">
        <Image condition="is">C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe</Image>
        <Rule groupRelation="and">
          <Image condition="begin with">C:\Program Files (x86)\Microsoft\Edge\Application\</Image>
          <Image condition="end with">\BHO\ie_to_edge_stub.exe</Image>
        </Rule>
        <Rule groupRelation="and">
          <Image condition="begin with">C:\Program Files (x86)\Microsoft\Edge\Application\</Image>
          <Image condition="end with">\identity_helper.exe</Image>
        </Rule>
        <Rule groupRelation="and">
          <Image condition="begin with">C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\</Image>
          <Image condition="contains">\MicrosoftEdge_X64_</Image>
        </Rule>
      </ProcessTampering>
    </RuleGroup>
  </EventFiltering>
</Sysmon>