Detect Credential API Hooking in Splunk

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| eval EventCode=coalesce(EventCode, event_id)
(
  (
    EventCode=8
    (TargetImage="*\\lsass.exe" OR TargetImage="*\\winlogon.exe" OR
     TargetImage="*\\chrome.exe" OR TargetImage="*\\firefox.exe" OR
     TargetImage="*\\iexplore.exe" OR TargetImage="*\\msedge.exe" OR
     TargetImage="*\\outlook.exe" OR TargetImage="*\\mstsc.exe" OR
     TargetImage="*\\explorer.exe" OR TargetImage="*\\svchost.exe")
    NOT (SourceImage="*\\csrss.exe" OR SourceImage="*\\svchost.exe"
         OR SourceImage="*\\services.exe" OR SourceImage="*\\wininit.exe"
         OR SourceImage="*\\MsMpEng.exe")
  )
  OR
  (
    EventCode=10
    TargetImage="*\\lsass.exe"
    (GrantedAccess="0x1010" OR GrantedAccess="0x1410" OR
     GrantedAccess="0x147a" OR GrantedAccess="0x143a" OR
     GrantedAccess="0x1438" OR GrantedAccess="0x1fffff")
    NOT (SourceImage="*\\MsMpEng.exe" OR SourceImage="*\\svchost.exe"
         OR SourceImage="*\\csrss.exe" OR SourceImage="*\\werfault.exe"
         OR SourceImage="*\\taskmgr.exe" OR SourceImage="*\\services.exe"
         OR SourceImage="*\\vmtoolsd.exe" OR SourceImage="*\\lsm.exe")
  )
  OR
  (
    EventCode=7
    (ImageLoaded="*hook*" OR ImageLoaded="*inject*" OR ImageLoaded="*detour*"
     OR ImageLoaded="*spy*" OR ImageLoaded="*intercept*")
    NOT (ImageLoaded="*\\Windows\\System32\\*" OR ImageLoaded="*\\Windows\\SysWOW64\\*"
         OR ImageLoaded="*\\Program Files\\*" OR ImageLoaded="*\\Program Files (x86)\\*")
  )
  OR
  (
    EventCode=1
    (CommandLine="*SetWindowsHookEx*" OR CommandLine="*WriteProcessMemory*"
     OR CommandLine="*VirtualAllocEx*" OR CommandLine="*CredEnumerate*"
     OR CommandLine="*CryptUnprotectData*" OR CommandLine="*LsaLogonUser*"
     OR CommandLine="*IAT*hook*" OR CommandLine="*inline*hook*")
  )
)
| eval DetectionType=case(
    EventCode==8, "RemoteThreadCreateIntoCredProcess",
    EventCode==10, "LSASSMemoryAccessForHooking",
    EventCode==7, "SuspiciousHookDLLLoaded",
    EventCode==1, "HookRelatedCommandLine",
    true(), "Unknown"
  )
| eval TargetProc=coalesce(TargetImage, "N/A")
| eval SourceProc=coalesce(SourceImage, Image, "N/A")
| eval AccessGranted=coalesce(GrantedAccess, "N/A")
| eval DLLLoaded=coalesce(ImageLoaded, "N/A")
| eval CmdLine=coalesce(CommandLine, "N/A")
| stats count as EventCount,
        values(DetectionType) as DetectionTypes,
        values(TargetProc) as TargetProcesses,
        values(AccessGranted) as AccessRights,
        values(DLLLoaded) as SuspiciousDLLs,
        earliest(_time) as FirstSeen,
        latest(_time) as LastSeen
        by host, SourceProc, CmdLine, User
| eval RiskScore=mvcount(DetectionTypes)
| eval TimeDeltaMinutes=round((LastSeen - FirstSeen) / 60, 2)
| where RiskScore >= 1
| table host, User, SourceProc, CmdLine, DetectionTypes, TargetProcesses,
        AccessRights, SuspiciousDLLs, EventCount, RiskScore,
        FirstSeen, LastSeen, TimeDeltaMinutes
| sort - RiskScore, - EventCount