Add section mapping injection detection signature

[kevross33]

This file implements a signature for detecting section mapping injection techniques used to inject code into remote processes.

8490daab736aa638b500b27c962a8250bbb8615ae1c68ef77494875ac9d2ada2 Kazuar
cf9d3ba6a9a8771d398902e71e90000752e25c4dbe9aa86ad3c6f29a7d5c843d AgentTesla

[gemini-code-assist]

Code Review

This pull request introduces a new Windows signature, SectionMappingInjection, designed to detect code injection by monitoring shared memory sections mapped into both local and remote processes. The review identified several logic issues in the on_call method, including the omission of MapViewOfFile calls due to missing process handles, potential handle collisions across different processes, and redundant reporting of injection events. A comprehensive code suggestion was provided to scope handles by PID, handle MapViewOfFile correctly, and ensure unique reporting.