Adir Shitrit 05a2a5e063 Implement APC injection detection with alertable state monitoring ...

- Detect threads in alertable wait states (prime APC targets)
- Monitor suspicious thread start addresses
- NtQueryInformationThread integration for APC queue inspection
- Module base resolution for thread address validation
- Cross-platform stubs for Linux/macOS

Detects MITRE ATT&CK T1055.004 (Asynchronous Procedure Call).

Generated with [Claude Code](https://claude.com/claude-code)

2025-11-21 00:52:11 +02:00

..

src

Implement APC injection detection with alertable state monitoring

2025-11-21 00:52:11 +02:00

tests

Fix all clippy lints and pass CI checks

2025-11-20 15:13:16 +02:00

Cargo.toml

Add YARA dependency and implement rule compilation

2025-11-21 00:35:37 +02:00