KAV exclusion

[PiRomant]

A lot of flood by

Process accessed:
RuleName: technique_id=T1055,technique_name=Process Injection
SourceImage: C:\Program Files (x86)\Kaspersky Lab\KES.12.2.0\avp.exe

It would be better to exclude directory C:\Program Files (x86)\Kaspersky Lab\, because various Kaspersky Lab security tools are located there.

C:\Program Files (x86)\Kaspersky Lab\KES.12.2.0
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security for Windows Server
C:\Program Files (x86)\Kaspersky Lab\Endpoint Agent
C:\Program Files (x86)\Kaspersky Lab\NetworkAgent

I also suggest changing the path here too:

sysmon-modular/12_13_14_registry_event/exclude_kaspersky_lab_internet_security.xml

Lines 5 to 6 in a9ff298

	<Image condition="begin with">C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security </Image>
	<Image condition="begin with">C:\Program Files\Kaspersky Lab\Kaspersky Internet Security </Image>