Potential Credential Access via Windows Utilities

process where event.type in ("start", "process_started") and /* update
here with any new lolbas with dump capability */
(process.pe.original_file_name == "procdump" and process.args : "-ma")
or (process.name : "ProcessDump.exe" and not process.parent.executable
: "C:\\Program Files*\\Cisco Systems\\*.exe") or
(process.pe.original_file_name == "WriteMiniDump.exe" and not
process.parent.executable : "C:\\Program Files*\\Steam\\*.exe") or
(process.pe.original_file_name == "RUNDLL32.EXE" and (process.args :
"MiniDump*" or process.command_line : "*comsvcs.dll*#24*")) or
(process.pe.original_file_name == "RdrLeakDiag.exe" and process.args :
"/fullmemdmp") or (process.pe.original_file_name == "SqlDumper.exe"
and process.args : "0x01100*") or (process.pe.original_file_name ==
"TTTracer.exe" and process.args : "-dumpFull" and process.args :
"-attach") or (process.pe.original_file_name == "ntdsutil.exe" and
process.args : "create*full*") or (process.pe.original_file_name ==
"diskshadow.exe" and process.args : "/s")