@KevinTheJedi
So I guess one more question: what is the behavior in 1.14? Will we be able to do SLAs based on response time or is it still going to be based on close time?

OK so I got it too late. If anyone is still using version 12 here's the full SQL

SELECT ticket_id FROM ost_ticket T1 USE INDEX (status_id)
INNER JOIN ost_ticket_status status ON (status.id=T1.status_id AND status.state="open")
LEFT JOIN ost_sla T2 ON (T1.sla_id=T2.id AND T2.flags & 1 = 1)
WHERE isoverdue=0 AND
((reopened is NULL AND duedate is NULL AND TIME_TO_SEC(TIMEDIFF(NOW(),T1.created))>=T2.grace_period3600)
OR (reopened is NOT NULL AND duedate is NULL AND TIME_TO_SEC(TIMEDIFF(NOW(),reopened))>=T2.grace_period3600)
OR (duedate is NOT NULL AND duedate<NOW()) ) AND T1.lastupdate = T1.created ORDER BY T1.created LIMIT 50;

File: includes\class.tickets.php
Row: 4216 (or there abouts)
There are a few updates to make to the above. Take a look at the existing sql query as it uses variables for the ost_ticket table and others.

@KevinTheJedi Any clues on the new format? My simple solution was just to check to see if the T1.lastupdate = T1.created as then we know the ticket wasn't updated since the create date/time.

The new format (still trying to wrap my head around it), appears to let us assign variables to the array, but I have no idea how to make the array reference the existing data.

Still looking but any help would be appreciated (even just a nudge to a line to look at)!

EDIT: This is no good either. So when you say, is the create_date equal to the last_update date, that includes ANY updates. So if you assigned a ticket, boom! You just updated the ticket... not so good. So DONT DO THIS!!!

See my answer below for a better method on version 14. (The same kind of thing could be done for version 12)

Or is this it?
Edit: NO THIS IS BAD!

static function checkOverdue() {
        $overdue = static::objects()
            ->filter(array(
                'isoverdue' => 0,
                'status__state' => 'open',
				'create_date' => 'Ticket.last_update',
                Q::any(array(
                    Q::all(array(
                        'duedate__isnull' => true,
                        'est_duedate__isnull' => false,
                        'est_duedate__lt' => SqlFunction::NOW()),
                        ),
                    Q::all(array(
                        'duedate__isnull' => false,
                        'duedate__lt' => SqlFunction::NOW())
                        )
                    ))
                ))
            ->limit(100);

        foreach ($overdue as $ticket)
            $ticket->markOverdue();

    }

Yes, and I figured it out!

Here is the code change (one line!):

File: include\class.ticket.php 
Line: 4599

static function checkOverdue() {
        $overdue = static::objects()
            ->filter(array(
                'isoverdue' => 0,
                'status__state' => 'open',
				'status_id' => 1,  // THIS LINE HERE 
                Q::any(array(
                    Q::all(array(
                        'duedate__isnull' => true,
                        'est_duedate__isnull' => false,
                        'est_duedate__lt' => SqlFunction::NOW()),
                        ),
                    Q::all(array(
                        'duedate__isnull' => false,
                        'duedate__lt' => SqlFunction::NOW())
                        )
                    ))
                ))
            ->limit(100);

        foreach ($overdue as $ticket)
            $ticket->markOverdue();

    }

So the logic behind this is that we now added 3 more "open" statuses (or statusstate in the code). Then when we reply we change to another status.
Those statuses are: In Progress, Waiting for End User, Waiting on Vendor/Parts.

The new line then says, it will only mark as over due when the status is Open (status ID 1) and the rest of the normal criteria.

Hoping this helps someone else too!