Credential Dumping Tools - File Artifacts

Original query, unchanged.

// Enter a reference list of malicious file artifacts
let MaliciousFileArtifacts = dynamic (["lsass.dmp","test.pwd","lsremora.dll","lsremora64.dll","fgexec.exe","pwdump","kirbi","wce_ccache","wce_krbtkts","wceaux.dll","PwHashes","SAM.out","SECURITY.out","SYSTEM.out","NTDS.out" "DumpExt.dll","DumpSvc.exe","cachedump64.exe","cachedump.exe","pstgdump.exe","servpw64.exe","servpw.exe","pwdump.exe","fgdump-log"]);
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID==11
| parse EventData with * 'TargetFilename">' TargetFilename "<" *
| where TargetFilename has_any (MaliciousFileArtifacts)
| parse EventData with * 'ProcessGuid">' ProcessGuid "<" * 'Image">' Image "<" *
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, Image, ProcessGuid, TargetFilename
| extend HostName = split(Computer, '.', 0)[0], DnsDomain = strcat_array(array_slice(split(Computer, '.'), 1, -1), '.')