Add Scylla PE detection rule

Add a Detect It Easy rule (db/PE/tool_Scylla.6.sg) to identify Scylla reconstructed PE dumps. The script (authored by DosX) skips .NET binaries, checks the last section for the name ".SCY" and a characteristics mask (0xe0000020), and marks the sample as a reconstructed dump by setting sOptions and bDetected. Includes upstream project link metadata.

db/PE/tool_Scylla.6.sg

@@ -0,0 +1,22 @@
+// Detect It Easy: detection rule file
+
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+// https://github.com/ntquery/scylla
+meta("tool", "Scylla");
+
+function detect() {
+    if (PE.isNet()) return; // Doesn't support .NET
+
+    var lastSection = PE.section[PE.getNumberOfSections() - 1];
+
+    if (lastSection.Name === ".SCY" && lastSection.Characteristics & 0xe0000020) {
+        sOptions = "reconstructed dump";
+        bDetected = true;
+    }
+
+    return result();
+}