Potential Credential Access via Windows Utilities

process where host.os.type == "windows" and event.type == "start" and
(
  (
    (?process.pe.original_file_name : "procdump" or process.name : "procdump.exe") and process.args : "-ma"
  ) or
  (
    process.name : "ProcessDump.exe" and not process.parent.executable regex~ """C:\\Program Files( \(x86\))?\\Cisco Systems\\.*"""
  ) or
  (
    (?process.pe.original_file_name : "WriteMiniDump.exe" or process.name : "WriteMiniDump.exe") and
      not process.parent.executable regex~ """C:\\Program Files( \(x86\))?\\Steam\\.*"""
  ) or
  (
    (?process.pe.original_file_name : "RUNDLL32.EXE" or process.name : "RUNDLL32.exe") and
      (
        process.args : "*MiniDump*" or
        process.command_line : ("*comsvcs*#*24*", "*#*24* full*", "*comsvcs*24* full*")
      )
  ) or
  (
    (?process.pe.original_file_name : "RdrLeakDiag.exe" or process.name : "RdrLeakDiag.exe") and
      process.args : "/fullmemdmp"
  ) or
  (
    (?process.pe.original_file_name : "SqlDumper.exe" or process.name : "SqlDumper.exe") and
      process.args : "0x01100*") or
  (
    (?process.pe.original_file_name : "TTTracer.exe" or process.name : "TTTracer.exe") and
      process.args : "-dumpFull" and process.args : "-attach") or
  (
    (?process.pe.original_file_name : "ntdsutil.exe" or process.name : "ntdsutil.exe") and
      process.args : "cr*fu*") or
  (
    (?process.pe.original_file_name : "diskshadow.exe" or process.name : "diskshadow.exe") and process.args : "/s")
)