Merge pull request #240 from randomaccess3/master

add image to executableinfo
EricZimmerman · Sep 5, 2024 · 1029228 · 1029228
2 parents 7497eaa + 40a9532
commit 1029228
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/evtx/Maps/Microsoft-Windows-Sysmon-Operational_Microsoft-Windows-Sysmon_3.map b/evtx/Maps/Microsoft-Windows-Sysmon-Operational_Microsoft-Windows-Sysmon_3.map
@@ -57,6 +57,13 @@ Maps:
       -
         Name: User
         Value: "/Event/EventData/Data[@Name=\"User\"]"
+  -
+    Property: ExecutableInfo
+    PropertyValue: "%Image%"
+    Values:
+      -
+        Name: Image
+        Value: "/Event/EventData/Data[@Name=\"Image\"]"
 
 # Documentation:
 # https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon#events