refactor(evasion): Stop gating CreateFile with open disposition

With approvers many CreateFile events with OPEN disposition mask are rejected early. This allows us to
dispatch all CreateFile events to the evasion scanners
regardless of the file operation.

Author: rabbitstack

internal/evasion/scanner.go

@@ -56,13 +56,6 @@ func NewScanner(config Config) *Scanner {
 }
 
 func (s *Scanner) ProcessEvent(e *event.Event) (bool, error) {
-	// filter out CreateFile events with the open disposition
-	// as they tend to be noisy and could impact performance
-	// when hitting evasion detectors
-	if e.IsOpenDisposition() {
-		return true, nil
-	}
-
 	var enq bool
 
 	// run registered evasion detectors