Renamed ProcDump Execution
Detects the execution of a renamed ProcDump executable. This is often done by attackers or malware in order to evade defensive mechanisms. The rule looks for processes with an original filename of 'procdump' or command-line arguments indicative of ProcDump usage (e.g., '-ma', '-mp', '/accepteula'), while filtering out executions where the image name is still 'procdump.exe' or 'procdump64.exe'.
Sigma
