Query ran to detect Process Reimaging behavior

SQL Query for Process Reimaging

SELECT 
    a.computer_name,
    a.OriginalFileName,
    a.LogonId,
    b.ProcessId,
    c.TargetFilename
FROM processreimaging a
JOIN processreimaging b
    ON a.ProcessGuid = b.ProcessGuid
    AND b.channel = "Microsoft-Windows-Sysmon/Operational"
    AND b.event_id = 7
    AND a.OriginalFileName = b.OriginalFileName
    AND a.Image = b.ImageLoaded
JOIN processreimaging c
    ON a.ParentProcessGuid = c.ProcessGuid
    AND c.channel = "Microsoft-Windows-Sysmon/Operational"
    AND c.event_id = 11
    AND a.Image = c.TargetFilename 
WHERE
    a.channel = "Microsoft-Windows-Sysmon/Operational"
    AND a.event_id = 1
    AND a.IntegrityLevel = "High"
    AND LOWER(a.OriginalFileName) != LOWER(substring_index(a.Image, '\\\\', -1))