Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Query ran to detect Process Reimaging behavior
SELECT
a.computer_name,
a.OriginalFileName,
a.LogonId,
b.ProcessId,
c.TargetFilename
FROM processreimaging a
JOIN processreimaging b
ON a.ProcessGuid = b.ProcessGuid
AND b.channel = "Microsoft-Windows-Sysmon/Operational"
AND b.event_id = 7
AND a.OriginalFileName = b.OriginalFileName
AND a.Image = b.ImageLoaded
JOIN processreimaging c
ON a.ParentProcessGuid = c.ProcessGuid
AND c.channel = "Microsoft-Windows-Sysmon/Operational"
AND c.event_id = 11
AND a.Image = c.TargetFilename
WHERE
a.channel = "Microsoft-Windows-Sysmon/Operational"
AND a.event_id = 1
AND a.IntegrityLevel = "High"
AND LOWER(a.OriginalFileName) != LOWER(substring_index(a.Image, '\\\\', -1))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.