[rwth-security] Using process creation properties to catch evasion techniques