diff --git a/sysmonconfig.xml b/sysmonconfig.xml
new file mode 100644
index 0000000..c000c52
--- /dev/null
+++ b/sysmonconfig.xml
@@ -0,0 +1,5 @@
+<Sysmon schemaversion="4.90">
+  <EventFiltering>
+    <ProcessCreate onmatch="exclude"/>
+  </EventFiltering>
+</Sysmon>