v1.3.0 - Threat Intelligence & Weaponized Exploits

Major New Features

• Offline Vulnerability Knowledge Base (HijackLibs): The scanner now features a built-in Threat Intelligence engine. It cross-references discovered DLL hijack opportunities against known vulnerabilities (e.g., Teams, OneDrive, Discord). Matches receive a massive +15 Confidence score boost, are flagged with [HIJACKLIBS MATCH], and include direct exploit URLs.
• Automated PATH Exploitation Engine: Dynamically weaponizes writable directories in the %PATH%. It actively hunts for highly vulnerable native Windows services (like IKEEXT, SessionEnv, Spooler, WlanSvc, Schedule) that blindly poll the PATH for missing phantom DLLs, generating actionable attack paths.
• Massive Phantom DLL Expansion: We completely overhauled the database, expanding from 101 to 497 unique, highly-targeted DLLs across 25 categories (including .NET/CLR, Third-Party Sideloading, COM/OLE, AMSI/Defender tools, and Virtualization).

Improvements & Fixes

• Integrated Knowledge Base intelligence directly into the AutoElevate Side-Loading Simulation and .local Redirect checks.
• Restructured TieredScorer to accurately clamp confidence bounds and properly rank Threat Intel findings at the Confirmed and High tiers.