Your fix is incorrect. In sysmon :

• If you want every possible event (i.e include_all.xml), you set a match on "exclude" with no rule. Nothing can match, therefore nothing is excluded, therefore everything is included.

      <ProcessTampering onmatch="exclude">
      </ProcessTampering>

• If you don't want any event (i.e exclude_all.xml), you set a match on "exclude" with no rule. Nothing can match, therefore nothing is included, therefore everything is excluded.

      <ProcessTampering onmatch="include">
      </ProcessTampering>

Got it ?

The file from the repo is correct.