ghost-core/Cargo.toml

[package]
name = "ghost-core"
version.workspace = true
edition.workspace = true
authors.workspace = true
license.workspace = true

[features]
default = []
yara-scanning = ["yara"]
vendored-openssl = ["reqwest/native-tls-vendored"]

[dependencies]
anyhow.workspace = true
thiserror.workspace = true
log.workspace = true
tokio = { version = "1.0", features = ["full"] }
serde = { version = "1.0", features = ["derive"] }
serde_json = "1.0"
uuid = { version = "1.0", features = ["v4"] }
toml = "0.8"
chrono = { version = "0.4", features = ["serde"] }
yara = { version = "0.28", optional = true }
sha2 = "0.10"
reqwest = { version = "0.11", features = ["json"] }

[target.'cfg(windows)'.dependencies]
windows = { version = "0.58", features = [
    "Win32_Foundation",
    "Win32_System_Diagnostics_ToolHelp",
    "Win32_System_Diagnostics_Debug",
    "Win32_System_Threading",
    "Win32_System_ProcessStatus",
    "Win32_System_Memory",
    "Win32_System_LibraryLoader",
    "Win32_System_Kernel",
    "Win32_Security",
    "Win32_UI_WindowsAndMessaging",
] }

[target.'cfg(unix)'.dependencies]
libc = "0.2"
add ghost-core with basic process enumeration 2025-11-07 18:02:30 +02:00			`[package]`
			`name = "ghost-core"`
			`version.workspace = true`
			`edition.workspace = true`
			`authors.workspace = true`
			`license.workspace = true`

Fix anomaly detection issues and add missing functionality Fixed issues: - Corrected Welford's online algorithm for variance calculation - Added NaN and infinity guards to prevent invalid calculations - Added Serialize/Deserialize traits to AnomalyScore and ProcessProfile Added functionality: - Profile persistence with save_profiles() and load_profiles() - Global baseline computation from all process profiles - Profile cleanup method to remove stale profiles - Additional utility methods for profile management 2025-11-21 12:49:42 +02:00			`[features]`
			`default = []`
			`yara-scanning = ["yara"]`
fix: use reqwest native-tls-vendored feature for musl 2025-11-21 16:00:51 +02:00			`vendored-openssl = ["reqwest/native-tls-vendored"]`
Fix anomaly detection issues and add missing functionality Fixed issues: - Corrected Welford's online algorithm for variance calculation - Added NaN and infinity guards to prevent invalid calculations - Added Serialize/Deserialize traits to AnomalyScore and ProcessProfile Added functionality: - Profile persistence with save_profiles() and load_profiles() - Global baseline computation from all process profiles - Profile cleanup method to remove stale profiles - Additional utility methods for profile management 2025-11-21 12:49:42 +02:00
add ghost-core with basic process enumeration 2025-11-07 18:02:30 +02:00			`[dependencies]`
			`anyhow.workspace = true`
			`thiserror.workspace = true`
			`log.workspace = true`
update dependencies for async and serialization support 2025-11-08 11:47:46 +02:00			`tokio = { version = "1.0", features = ["full"] }`
			`serde = { version = "1.0", features = ["derive"] }`
			`serde_json = "1.0"`
			`uuid = { version = "1.0", features = ["v4"] }`
add configuration system with TOML support 2025-11-08 12:20:53 +02:00			`toml = "0.8"`
Fix anomaly detection issues and add missing functionality Fixed issues: - Corrected Welford's online algorithm for variance calculation - Added NaN and infinity guards to prevent invalid calculations - Added Serialize/Deserialize traits to AnomalyScore and ProcessProfile Added functionality: - Profile persistence with save_profiles() and load_profiles() - Global baseline computation from all process profiles - Profile cleanup method to remove stale profiles - Additional utility methods for profile management 2025-11-21 12:49:42 +02:00			`chrono = { version = "0.4", features = ["serde"] }`
			`yara = { version = "0.28", optional = true }`
Enhance process hollowing detection with deep PE comparison Added comprehensive section-by-section PE comparison that reads the executable from disk, parses PE sections, and compares them against memory using SHA-256 hashing. Detects: - Modified code sections (>5% difference from disk) - Missing PE sections in memory - Section hash mismatches This catches sophisticated hollowing techniques that modify specific code sections while preserving the PE header structure. 2025-11-21 01:08:49 +02:00			`sha2 = "0.10"`
Implement real threat intelligence feed integration Added actual HTTP-based feed fetching for: - AbuseIPDB - IP address blacklist with confidence scoring - MalwareBazaar - Recent malware samples with SHA256 hashes - AlienVault OTX - Threat pulses with multiple IOC types Each feed properly parses JSON responses, extracts indicators of compromise (IOCs), caches them with appropriate TTLs, and maps threat levels. Feeds require API keys and can be enabled/disabled individually. IOC cache supports multiple indicator types including IPs, file hashes, and filenames. 2025-11-21 01:10:04 +02:00			`reqwest = { version = "0.11", features = ["json"] }`
add ghost-core with basic process enumeration 2025-11-07 18:02:30 +02:00
			`[target.'cfg(windows)'.dependencies]`
			`windows = { version = "0.58", features = [`
			`"Win32_Foundation",`
			`"Win32_System_Diagnostics_ToolHelp",`
feat: Add PE header validation and LD_PRELOAD detection 2025-11-17 22:02:41 +02:00			`"Win32_System_Diagnostics_Debug",`
add ghost-core with basic process enumeration 2025-11-07 18:02:30 +02:00			`"Win32_System_Threading",`
			`"Win32_System_ProcessStatus",`
			`"Win32_System_Memory",`
feat: Add PE header validation and LD_PRELOAD detection 2025-11-17 22:02:41 +02:00			`"Win32_System_LibraryLoader",`
Fix Windows compilation errors - Added Win32_System_Kernel feature for CONTEXT structure support - Added MemoryRead error variant to GhostError enum - Fixed all MemoryReadError -> MemoryRead { message } conversions - Fixed all ConfigurationError -> Configuration { message } conversions - Added missing HashMap import in pe_parser.rs - Removed unused imports (ReadProcessMemory, HANDLE, std::mem) - Prefixed unused variables with underscore (_file_header, _suspicious_start_patterns) This fixes all Windows build errors on CI/CD. 2025-11-21 14:47:38 +02:00			`"Win32_System_Kernel",`
add ghost-core with basic process enumeration 2025-11-07 18:02:30 +02:00			`"Win32_Security",`
Fix Windows/macOS build errors - add Win32_UI feature and remove unused imports 2025-11-20 15:36:28 +02:00			`"Win32_UI_WindowsAndMessaging",`
add ghost-core with basic process enumeration 2025-11-07 18:02:30 +02:00			`] }`

			`[target.'cfg(unix)'.dependencies]`
			`libc = "0.2"`