feat(rules): detect ReadDirectoryChanges shellcode via callback and APC (#1095)

[sherkhanz]

This PR resolves #1095.

• Updated callback rule to include ReadDirectoryChanges.
• Added a new standalone rule for APC-based execution (targeting the provided PoC).

References

• https://osandamalith.com/2025/09/25/executing-shellcode-with-readdirectorychangess-hidden-callback/
• https://github.com/OsandaMalith/CallbackShellcode/blob/main/ReadDirectoryChanges.c

Rule validation against the standalone YAML file

Validation within the full ruleset context

Fixes #1095

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[mike-hunhoff]

Suggested change

- https://github.com/mandiant/capa-rules/issues/1095

[mike-hunhoff]

Please review the rule documentation to understand how capa handles APIs with A/W variants and update accordingly.

[mike-hunhoff]

Please review the rule documentation to understand how capa handles APIs with A/W variants and update accordingly.

[mike-hunhoff]

@sherkhanz lints are failing. Please ensure all lints and tests pass locally before requesting another review.

[mike-hunhoff]

Actually, this is a dup of #1140

[sherkhanz]

Thanks for the review and for pointing this out. Understood on the A/W handling, lint requirements, and the duplicate with #1140. I’ll review the rule documentation more carefully and use this in my next contribution.