mirror of
https://github.com/8damon/Blackbird-Platform
synced 2026-06-21 13:41:12 +00:00
dutchpsycho
252c322fe3
New background service that accepts file-path, memory-sample, and page-sample scan requests via a ConcurrentQueue. A single worker thread dequeues items and evaluates them against the loaded YARA ruleset. File scans are bounded by MaxFileBytes (16 MiB) and results are cached by normalized path to avoid re-scanning the same binary during a session. Memory and page scans use a 4096-byte sample window. Matching findings are published as HeuristicEventView items into the analysis heuristics surface. The service loads rules from the Rules/SignatureIntel directory on first use and exposes Enable/MemoryScan/PageScan/HashScan options through SignatureIntelOptions. Closes #9.