feat: add limacharlie edr scan

pkg/resources/scan_edr.go

@@ -30,4 +30,5 @@ var (
 	SophosEDR       EDRType = "sophos"
 	FortinetEDR     EDRType = "fortinet"
 	MalwareBytesEDR EDRType = "malwarebytes"
+	LimacharlieEDR  EDRType = "limacharlie"
 )

pkg/scanners/scan_limacharlie.go

@@ -0,0 +1,28 @@
+package scanners
+
+import "github.com/FourCoreLabs/EDRHunt/pkg/resources"
+
+type LimacharlieDetection struct{}
+
+func (w *LimacharlieDetection) Name() string {
+	return "Limacharlie EDR"
+}
+
+func (w *LimacharlieDetection) Type() resources.EDRType {
+	return resources.LimacharlieEDR
+}
+
+var LimacharlieHeuristic = []string{
+	"lc_sensor.exe",
+	"refractionPOINT HCP",
+	"LimaCharlie",
+}
+
+func (w *LimacharlieDetection) Detect(data resources.SystemData) (resources.EDRType, bool) {
+	_, ok := data.CountMatchesAll(LimacharlieHeuristic)
+	if !ok {
+		return "", false
+	}
+
+	return resources.DeepInstinctEDR, true
+}

pkg/scanners/scanner.go

@@ -25,5 +25,6 @@ var (
 		&SophosDetection{},
 		&FortinetDetection{},
 		&MalwareBytesDetection{},
+		&LimacharlieDetection{},
 	}
 )