Create Linux.ExtractKthread Artifact (#896)

Adding an artifact to help in the detection of imposter threads in
Linux. Parses /proc/[0-9]*/status files and extracts the ProcessName and
Kthread values.

content/exchange/artifacts/Linux.Collection.Kthread.yaml

@@ -0,0 +1,36 @@
+name: Linux.ExtractKthread
+author: Andy Swift
+description: |
+  This artifact parses `/proc/[0-9]*/status` files and extracts the `ProcessName` and `Kthread` values. Helpful for identifying imposter processes.
+
+type: CLIENT
+
+precondition: SELECT OS FROM info() WHERE OS = "linux"
+
+parameters:
+  - name: FileNameGlob
+    description: Glob pattern to search for process status files.
+    default: "/proc/[0-9]*/status"
+    type: str
+
+sources:
+- name: extractKthread
+  query: |
+    LET FileInfos <= SELECT OSPath, read_file(filename=OSPath) AS content
+                     FROM glob(globs=FileNameGlob, accessor='file')
+                     WHERE content =~ 'Kthread:\\s*(\\d+)'
+
+    LET ParsedInfos <= SELECT OSPath,
+                          parse_string_with_regex(
+                            string=content,
+                            regex=[
+                              '^Name:\\s*(?P<Name>.+)',
+                              'Kthread:\\s*(?P<KthreadValue>\\d+)'
+                            ]
+                          ) AS ParsedContent
+                      FROM FileInfos
+
+    SELECT OSPath,
+           ParsedContent.Name AS ProcessName,
+           ParsedContent.KthreadValue AS Kthread
+    FROM ParsedInfos