Mechanism-based detections + cut default-exclude false-positive noise

[joaopege1]

What

Two complementary improvements that move the scanner from pure string-matching toward behaviour-based detection with far less noise.

1. Mechanism-based detections (catch techniques, not just known strings)

• fake-font — a .woff2/.woff/.ttf/... file whose bytes are actually text/script (the PolinRider loader disguise). HIGH. Reads only the first 16 bytes, so it runs even past the content-size cap and needs no signature update when the loader mutates.
• vscode-autorun combo — a tasks.json/settings.json that runs on folderOpen is LOW (legit VS Code feature); one that also fetches/executes a remote payload is HIGH. A bare https URL (e.g. $schema) is deliberately not treated as a fetch signal.
• exfil-archive-name — the campaign's staged-exfil naming user$host_YYMMDD_HHMMSS#hash.zip (MEDIUM).

2. Cut default-exclude false-positive noise

A full-/ scan was flagging ~70 hits that were all records that quote indicators, never payloads. Now skipped by default (restored with --no-default-excludes):

• The scanner's own cargo target/ tree (build artifacts + the deliberately-malicious test corpus), inferred from the running binary's path. Returns None for an installed binary so real files are never hidden.
• Chromium/Electron/VS Code app-data caches — Cache_Data, Code Cache, GPUCache, Dawn*Cache, IndexedDB, Service Worker, blob_storage, workspaceStorage — and *.vscdb state stores. These echo indicators you've viewed, typed, or discussed in Slack/VS Code, never an executable payload. (A bare Cache is intentionally not skipped — projects use it.)

Testing

• tests/heuristics.rs: each detection has a positive case (must flag) and a benign look-alike (must stay clean). Tests drive the real binary with --no-default-excludes since fixtures live under target/.
• cargo test (6 pass), cargo fmt --check, cargo clippy all clean.
• Verified on the reporter's machine: Slack cache, VS Code state.vscdb, and the tool's own target/tmp corpus now scan CLEAN by default and reappear under --no-default-excludes.

🤖 Generated with Claude Code