Wraith is a low-level Rust security sensor that answers a question most tools can't: "is this process being exploited right now?" By focusing entirely on anomalous runtime behavior rather than known signatures or payloads, Wraith detects live exploits and uncovers zero-day vulnerabilities completely in advance of a patch.

In-memory threat hunter: detects injected shellcode, phantom DLLs, hollowed regions, RWX pages with entropy analysis and MITRE ATT&CK mapping

Research reference — kernel shellcode detection methods for anti-cheat telemetry validation.