add image to executableinfo

EricZimmerman · Sep 5, 2024 · e4cc937 · e4cc937
1 parent 43d28b1
commit e4cc937
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/evtx/Maps/Microsoft-Windows-Sysmon-Operational_Microsoft-Windows-Sysmon_3.map b/evtx/Maps/Microsoft-Windows-Sysmon-Operational_Microsoft-Windows-Sysmon_3.map
@@ -57,6 +57,13 @@ Maps:
       -
         Name: User
         Value: "/Event/EventData/Data[@Name=\"User\"]"
+  -
+    Property: ExecutableInfo
+    PropertyValue: "%Image%"
+    Values:
+      -
+        Name: Image
+        Value: "/Event/EventData/Data[@Name=\"Image\"]"
 
 # Documentation:
 # https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon#events
@@ -104,4 +111,4 @@ Maps:
 #    <Data Name="DestinationPort">49304</Data>
 #    <Data Name="DestinationPortName"></Data>
 #  </EventData>
-# </Event>
+# </Event>