Renamed CreateDump Utility Execution for Memory Dumping
This rule detects the execution of the `createdump.exe` utility, or a renamed version of it, when used to dump process memory. It specifically looks for command-line arguments indicative of memory dumping, such as combinations of `-u`, `-f`, and `.dmp` or `--full`, `--name`, and `.dmp`. The rule explicitly excludes instances where the executable is named `createdump.exe` to focus on renamed binaries, which is a common evasion technique.
YARA-L
