Credential Access via Known Utilities

process where event.action == "start" and
 process.parent.name != null and 
 (
  (process.pe.original_file_name == "procdump" and process.args : "-ma" and process.command_line : "*lsass*") or
  (process.name : "ProcessDump.exe" and not process.parent.executable : "?:\\Program Files*\\Cisco Systems\\*.exe") or
  (process.pe.original_file_name == "WriteMiniDump.exe" and not process.parent.executable : "?:\\Program Files*\\Steam\\*.exe") or
  /* Issue #623 - added coverage for evasion via renamed comsvcs DLL */
  (process.pe.original_file_name == "RUNDLL32.EXE" and process.command_line : ("*comsvcs*24*", "*MiniDump*", "*#*24* full*")) or
  (process.pe.original_file_name == "RdrLeakDiag.exe" and process.args : "/fullmemdmp") or
  (process.pe.original_file_name == "SqlDumper.exe" and process.args : "0x01100*") or
  (process.pe.original_file_name == "TTTracer.exe" and process.args : "-dumpFull" and process.args : "-attach") or
  (process.pe.original_file_name == "ntdsutil.exe" and process.command_line : "*create*") or
  (process.pe.original_file_name == "diskshadow.exe" and process.args : "/s") or
  ((process.pe.original_file_name : "wbadmin.exe" or process.name : "wbadmin.exe") and
    process.args : "recovery" and process.command_line : "*ntds.dit*") or
  (process.pe.original_file_name == "esentutl.exe" and process.args : "/vss" and process.command_line : ("*ntds.dit*", "*\\SAM*", "*//SAM*")) or
  (process.pe.original_file_name == "esentutl.exe" and process.args : "/y" and process.command_line : ("*\\Cookies*", "*\\Login Data*")) or
  (process.pe.original_file_name == "reg.exe" and process.args : ("save", "export") and
   process.command_line : ("*HKLM*\\SAM *", "*hkey_local_machine*\\SAM *", "*HKLM\\security*",
                          "*hkey_local_machine\\security*", "*HKLM\\system *", "*hkey_local_machine\\system *")) or
  /* generic original filename and variable number of hashes */
  (process.name : "createdump.exe" and process.args : "-u") or 
  (process.pe.original_file_name == "FX_VER_INTERNALNAME_STR" and process.args : "-u" and process.args : "-f" and process.args_count >= 3) or
  /* Avast Home Security signed binary */
  (process.pe.original_file_name == "avDump.exe" and process.args : "–dump_file") or
  (process.pe.original_file_name == "DumpMinitool.exe" and process.args : "--dumpType")
  ) and not

  /* Issue #528 */
  (process.pe.original_file_name == "reg.exe" and
   process.parent.executable : ("?:\\Program Files\\Rapid7\\Insight Agent\\components\\insight_agent\\*\\ir_agent.exe",
                                "?:\\Program Files (x86)\\Rapid7\\Insight Agent\\components\\insight_agent\\*\\ir_agent.exe")) and not
  (process.pe.original_file_name == "diskshadow.exe" and process.parent.name : "powershell.exe" and process.parent.args : "?:\\OmniStackBackups\\backup*") and
  not (process.name : "rundll32.exe" and
       process.command_line : "*davclnt.dll,DavSetCookie*http*MiniDump*" and
       process.parent.executable : "?:\\WINDOWS\\system32\\svchost.exe" and process.parent.args : "WebClient") and
  not (process.pe.original_file_name == "reg.exe" and process.args : "?:\\ProgramData\\Bitdefender\\ForensicArtefacts\\System\\Config\\*" and
       process.parent.name : "cmd.exe") and
  not (process.executable : "C:\\Program Files (x86)\\Dental Intel\\PMSSyncService\\procdump.exe" and process.args : "office.exe") and 
  not (process.name : "diskshadow.exe" and process.parent.executable : "?:\\Windows\\Temp\\RackWare-winutil\\bin\\bash.exe" and 
       process.args : "?:\\windows\\Temp\\RackWare-winutil\\*") and
  not (process.name : "reg.exe" and process.parent.executable : "C:\\Program Files\\SF\\EDR\\agent\\bin\\sfavtray.exe") and
  not (process.name : "diskshadow.exe" and process.command_line : "*\\Program Files\\ARCServe\\*") and
  not (process.name : "reg.exe" and process.args : "save" and
       process.args : "?:\\Program Files\\Rapid7\\Insight Agent\\components\\insight_agent\\common\\ir_agent_tmp\\*" and
       process.working_directory : "?:\\Program Files\\Rapid7\\Insight Agent\\components\\insight_agent\\common\\") and
  not (process.name : "diskshadow.exe" and process.parent.executable : "C:\\Program Files\\Barracuda\\Barracuda Backup Agent\\win\\x86_64\\BackupService.exe")