ShellSweepPlus.ps1

<#
    ###########################################################################
    Script Name: ShellSweepPlus.ps1
    Authors: Michael Haag

    Version: 2.3
    Last Modified: 06-18-2024

    Description:
        ShellSweepPlus is the ultimate guardian for your web environments, meticulously designed to detect and neutralize webshells with unparalleled precision. Here are the enhanced features:
        
        - Dynamic Scans: Customize scans with `$DirectoryPaths`, `$excludePaths`, and `$ignoreHashes` to fine-tune the search parameters.

        - Precision Entropy Thresholds: Leverage a sophisticated nested hashtable `$fileExtensions` for tailored entropy thresholds across various file extensions, ensuring pinpoint accuracy in detections.
        
        - Multi-layered Detection: Integrates 'Entropy-based', 'Standard Deviation-based', and 'Mixed Mode' methods with dynamic weights. This multi-pronged strategy significantly boosts detection reliability.
        
        - Advanced Static Code Analysis: Utilizes `$suspiciousPatterns` for in-depth pattern-based detections, refining the detection process to catch even the most elusive threats.
        
        - Entropy Analysis: Employs the `Get-Entropy` function to measure content randomness, aiding in the identification of encrypted or obfuscated malicious content.
        
        - Enhanced Pattern Detection: Implements `Detect-WebshellPatterns` to identify known malicious patterns, fortifying the security framework.
        
        - Detailed Result Presentation: Potential threats are displayed in a structured JSON format, simplifying parsing and downstream processing.
        
        - Comprehensive Logging: Integrated `Write-Verbose` commands offer detailed insights into the script's operations, invaluable for debugging and operational transparency.

        - Heuristic Analysis: Introduces `Perform-HeuristicAnalysis` to detect anomalies based on heuristic rules, enhancing the detection of zero-day webshells.

        Usage:
            Specify directories in `$DirectoryPaths` for scanning.
            Modify `$suspiciousPatterns` as needed.
            Exclude specific directories using `$excludePaths`.
            Ignore certain file hashes using `$ignoreHashes` or specify a path with `$ignoreHashesFilePath`.
            Execute the script in PowerShell.

        Dependencies:
            - PowerShell 5.1 or later

        Notes:
            - Execute this script in a test environment initially to understand its behavior and outputs.
            - Always backup crucial data before implementing any automated action based on this script's results.
            - Regularly update the suspicious patterns, entropy thresholds to effectively counter evolving threats.
    ###########################################################################
#>

Write-Output @"
 ____  _          _ _ ____                         ____  _           
/ ___|| |__   ___| | / ___|_      _____  ___ _ __ |  _ \| |_   _ ___ 
\___ \| '_ \ / _ \ | \___ \ \ /\ / / _ \/ _ \ '_ \| |_) | | | | / __|
 ___) | | | |  __/ | |___) \ V  V /  __/  __/ |_) |  __/| | |_| \__ \
|____/|_| |_|\___|_|_|____/ \_/\_/ \___|\___| .__/|_|   |_|\__,_|___/
                                            |_|                      
"@

# Entropy thresholds and operations for each file extension using nested array of hashtables, each containing an 'operation' and a 'value'.
$fileExtensions = @{
    '.asp' = @(
        @{ 'operation' = 'lt'; 'value' = 0.805376867704514 },
        @{ 'operation' = 'gt'; 'value' =  5.51268104400858 }
    )
    '.ashx' = @(@{ 'operation' = 'gt'; 'value' =  3.75840459657413 })
    '.asax' = @(@{ 'operation' = 'gt'; 'value' = 3.7288741494524 })
    '.jspx' = @(@{ 'operation' = 'gt'; 'value' = 4.87651397975203 })
    '.html' = @(@{ 'operation' = 'gt'; 'value' = 4.8738392644771 })
    '.aspx' = @(
        @{ 'operation' = 'lt'; 'value' = 0.805376867704514 },
        @{ 'operation' = 'gt'; 'value' =  4.15186444439319 }
    )
}

# Define weights for detection methods
$weights = @{
    'Entropy-based' = 0.5
    'Standard Deviation-based' = 0.25
    'Mixed Mode' = 0.15
    'Heuristic-based' = 0.1
}

# Define suspicious patterns for static code analysis
$suspiciousPatterns = @(
    'server',
    'String',
    'DeflateStream',
    'runat',
    'width',
    'eval',
    'base64_decode',
    'exec',
    'shell_exec',
    'passthru',
    'system',
    'popen',
    'proc_open',
    'false',
    'Value',
    'style',
    'Visible',
    'ToString',
    'Response',
    'PUBLIC',
    'TableCell',
    'table',
    'TextBox',
    'Write',
    'Request',
    'object',
    'protected',
    'sender',
    'System',
    'align',
    'onclick',
    'catch',
    'EventArgs',
    'height',
    'input',
    'Exception',
    'return',
    'class',
    'ERROR',
    'Button',
    'color',
    'Label',
    'script',
    'center',
    'Message',
    'CssClass',
    'border',
    'Controls',
    'Replace',
    'fileName',
    'TableRow',
    'Length',
    'Session',
    'Namespace',
    'Import',
    'Attributes',
    'Close',
    'ListItem',
    'instr',
    'DataTable',
    'select',
    'directory',
    'action',
    'function',
    'Checked',
    'Count',
    'xseuB',
    'break',
    'foreach',
    'LinkButton',
    'margin',
    'private',
    'javascript',
    'solid',
    'ServerVariables',
    'Cells',
    'QueryString',
    'EnableViewState',
    'Append',
    'className',
    'title',
    'Items',
    'Panel',
    'Bin_Files',
    'Process',
    'Parse',
    'AXSbb',
    '100px',
    'innerText',
    'SqlCommand',
    'Dispose',
    'TreeNode',
    'encoding',
    'cellspacing',
    'colspan',
    'command',
    'background',
    'Result',
    'Password',
    'Bin_PostBack',
    'alert',
    'SqlConnection',
    'Substring',
    'Registry',
    'Database',
    'Bin_DataGrid',
    'FileInfo',
    'Bin_H2_Title',
    'default',
    'Version',
    'Properties',
    'DirectoryInfo',
    'IndexOf',
    'SelectedItem',
    'Empty',
    'padding',
    'Success',
    'UrlEncode',
    'Hidden',
    'master',
    'InnerHtml',
    'CheckBox',
    'target',
    'delete',
    'DirectoryEntry',
    'Focus',
    'CellPadding',
    'Environment',
    'Reg_Path',
    'Bin_Error',
    'submit',
    'WICxe',
    'onmouseover',
    'DropDownList',
    'location',
    'StartInfo',
    'FileAttributes',
    'Columns',
    'StreamWriter',
    'onmouseout',
    'Bin_FileList',
    'Query',
    'MapPath',
    'Content',
    'regkey',
    'right',
    'DataGridItem',
    'Buffer',
    'XP_CmdShell',
    'Regex',
    'OpenSubKey',
    'Exists',
    'Stream',
    'child',
    'DataBind',
    'Bin_Request',
    'TcpClient',
    'FileSize',
    'CommandType',
    'error_x',
    'FullName',
    'datetime',
    'ByVal',
    'INDEX',
    'StreamReader',
    'Microsoft',
    'Language',
    'Convert',
    'Start',
    'bin_cmd',
    'fname',
    'filepath',
    'StringBuilder',
    'textarea',
    'SetAttributes',
    'GetAttributes',
    'DB_NAME',
    'Split',
    'Tables',
    'fpath',
    'ForeColor',
    'newdir',
    'Execute',
    'option',
    'RegistryKey',
    'Bin_upTextBox',
    'LastIndexOf',
    'bottom',
    'SelectedNode',
    'decoration',
    'create',
    'xcleanpath',
    'DataSet',
    'ReadOnly',
    'sp_configure',
    'RECONFIGURE',
    'getall',
    'buttom',
    'clear',
    'UEbTI',
    'rename',
    'Upload',
    '_blank',
    'float',
    'Shell',
    'Int32',
    'Transitional',
    'sqlstr',
    'tblname',
    'contents',
    'declare',
    'Format',
    'param',
    'static',
    'ReadToEnd',
    'StartsWith',
    'instream',
    'Nodes',
    'getocmd',
    'Bin_folder',
    'Socket',
    'Bin_path',
    'xhtml1',
    'goaction',
    'Assembly',
    'strResult',
    'SelectedValue',
    'DataSource',
    'XHTML',
    'ElseIf',
    'Arguments',
    'Culture',
    'OleDbConnection',
    'neutral',
    'PublicKeyToken',
    'AutoPostBack',
    'tmpstr',
    'GetValue',
    'White',
    'Please',
    'ltcpClient',
    'Windows',
    'ExecuteNonQuery',
    'while',
    'AsyncCallback',
    'HKEY_LOCAL_MACHINE',
    'ToLower',
    'Bin_Scroll',
    'GetFileName',
    'SELECTED',
    'B03F5F7F11D50A3A',
    'files',
    'Thread',
    'NVarChar',
    'document',
    'TreeView4',
    'tqstr',
    'AddHeader',
    'history',
    'OleDb',
    'UserName',
    'Bin_DataTable',
    'summary',
    'OleDbDataAdapter',
    'Sp_Oacreate',
    'ToDateTime',
    'Archive',
    'Bin_Action',
    'IpParts1',
    'getselfurl',
    'Bin_DBinfoLabel',
    'Parameters',
    'display',
    'DataGrid',
    '009900',
    'rtcpClient',
    'zcg_ShowError',
    'Cmdpro',
    'State',
    'NetworkStream',
    'rootkey',
    'xfile',
    'mydir',
    'where',
    'TextMode',
    'Charset',
    'MSSQL',
    'CloneTime',
    'Bin_IISPanel',
    'myProcessStartInfo',
    'formatpath',
    '631px',
    'iisinfo',
    'OleDbCommand',
    'Label_Files',
    'Driver',
    'STATUS',
    'subkey',
    'ArrayList',
    'sysname',
    'chkall',
    'rootkit',
    'accstr',
    'Expanded',
    'backup',
    'LocalMachine',
    'prompt',
    'CONNECT',
    'Bin_LoginPanel',
    'Bin_RegPanel',
    'Bin_SQLPanel',
    'Bin_PortPanel',
    'Bin_SuPanel',
    'Bin_CmdPanel',
    'Bin_AccPanel',
    'Bin_DBmenuPanel',
    'Options',
    'confirm',
    'family',
    'IAsyncResult',
    'SocketFlags',
    'iaMKl',
    'Output',
    'recResult',
    '172px',
    'Domain',
    'Bin_dir',
    'Console',
    'Bin_Msg',
    'application',
    '52521',
    'Parent',
    'Children',
    'Access',
    'INSERT',
    'overflow',
    'Remove',
    'weight',
    'folder',
    'Provider',
    'SqlDataAdapter',
    'Cookies',
    'scanport',
    'DirectoryServices',
    'Image',
    'PortForward',
    'prostr',
    'TreeView2',
    'Bin_Table',
    'Bin_file',
    'information',
    'bgcolor',
    'Bin_MenuPanel',
    'Bin_dirPanel',
    'Diagnostics',
    'Upfile',
    'GetFiles',
    'localhost',
    'GetDirectories',
    'CommandText',
    'green',
    'Array',
    'source',
    'xmlns',
    'packet',
    'system32',
    'BackColor',
    'continue',
    'Sysinfo',
    'getspyrootfolder',
    'TreeView3',
    'advanced',
    'Wmi_Function',
    '__EVENTTARGET',
    'DOCTYPE',
    'IsMatch',
    'SqlClient',
    'jXkaE',
    'DPrPL',
    'SQL2005',
    'RaTGr',
    'click',
    'sqlrootkit',
    'Bin_Regread',
    'strValueName',
    'Integer',
    'd_file',
    'Connection',
    'AsyncState',
    'objfile',
    'Users',
    'Bin_FilePanel',
    'tempFile',
    'RadioButton',
    'ContentType',
    'ManagementObjectSearcher',
    'uppath',
    'RegexOptions',
    'myprocess',
    'IgnoreCase',
    'LOCAL_ADDR',
    'SqlDbType',
    'MultiLine',
    'Bin_ExecSql',
    'const',
    'PostedFile',
    'HKEY_CLASSES_ROOT',
    'HKEY_CURRENT_USER',
    'ProcessStartInfo',
    'HKEY_USERS',
    'HKEY_CURRENT_CONFIG',
    'filepath2',
    'RawLength',
    'TreeView5',
    'GetParent',
    'Description',
    '084B8E',
    'foldername',
    'Getparentdir',
    'DropDownList1',
    'switch',
    'program',
    'OnSelectedIndexChanged',
    'FFFFFF',
    'LastWriteTime',
    'Bin_TextBox_Path',
    'ListBox',
    'change',
    'GetString',
    'method',
    'Sendstr',
    'Bin_Listdir',
    'theform',
    'getjkrev',
    'Page_Load',
    'VALUES',
    'ProcessID',
    'BoundColumn',
    'Match',
    'allfile',
    'AUTHKEY',
    'adoConn',
    'vbhLn',
    'UseShellExecute',
    'PATH_TRANSLATED',
    'Tahoma',
    'Params',
    'PhysicalApplicationPath',
    'dAJTD',
    'RedirectStandardOutput',
    'StandardOutput',
    'dQIIF',
    'About',
    'OpenConnection',
    'cmdstr',
    'iisstr',
    'PATH_INFO',
    'ShowError',
    'shell_color',
    'Bin_Databind',
    'Black',
    'ConnectionString',
    'GetBytes',
    'hover',
    'MachineName',
    'TableName',
    'dColumn',
    '000000',
    'BeginReceive',
    'commandargument',
    'newdir1',
    'oEnum',
    'sp_oamethod',
    'Arial',
    'Control',
    'GetLogicalDrives',
    'current',
    'myString',
    'config',
    'newfile',
    'HttpUtility',
    'OSVersion',
    'SaveAs',
    'Security',
    'ServiceProcess',
    'SelectCommand',
    'TEMP2',
    'getElementById',
    'finally',
    'validateRequest',
    'ToolTip',
    '300px',
    'Bin_CopytoTextBox',
    'Login',
    'Bin_SQLRadioButton',
    'form1',
    'modified',
    'patharray',
    'Flush',
    'Disposition',
    '763px',
    'Debug',
    'Bin_DBstrTextBox',
    'Threading',
    'getjksend',
    'attachment',
    'ASPXSpy',
    'acctable',
    '43958',
    'nowrap',
    'ListBox3',
    'fields_split',
    'mysession',
    'getport',
    'FF0000',
    'Bin_Createfile',
    'SqlDataReader',
    'CreateDirectory',
    'RegularExpressions',
    'Maintenance',
    'PortNo',
    'GetStream',
    'zcg_GetTableRow',
    'Sockets',
    'download',
    'tmpbyte',
    'IPEndPoint',
    'sfile',
    'wscript',
    'GridView1',
    'ClassesRoot',
    'ComputerName',
    'FileManager',
    'UnixTime',
    'Caption',
    'ProcessName',
    'Nothing',
    'DdmPl',
    'Search',
    'showfolder',
    'ListBox4',
    'kQmRu',
    'connstr',
    'Redirect',
    'kRXgt',
    'TEMP1',
    'lyTOK',
    'Win32',
    'oJiym',
    'drivers',
    '119px',
    'hwJeS',
    'ljtzC',
    'Bin_Td_Res',
    'ConnectionState',
    'AllowPaging',
    'Verdana',
    'block',
    'HEADER',
    'FileStream',
    'Boolean',
    'FOOTER',
    'PacketCapture',
    'using',
    'addextendedproc',
    'Timestamp',
    'sp_makewebtask',
    'm_Writer',
    'db_owner',
    '0x62696E',
    'GetSize',
    'style3',
    'LastAccessTime',
    'Bin_login',
    'GroupName',
    'DataRow',
    'CreationTime',
    'SQLOLEDB',
    'sysobjects',
    'LocalPort',
    'Localaddress',
    'Clone',
    'ExecuteReader',
    'CurrentUser',
    'Management',
    'IISSpy',
    '__File',
    'mywrite',
    'CurrentConfig',
    'fileconfigpath',
    'strTmp',
    'strong',
    'getfs',
    'Bin_ToBase64',
    'Trace',
    'Bin_MainPanel',
    'TreeView1',
    'Bin_CopyTextBox',
    'db_info',
    'TreeView',
    'SERVER_PORT',
    'Bin_SAexecButton',
    'Bin_Accbind',
    'ASCII',
    'oleconn',
    'typeof',
    'is_dir',
    '150px',
    'ULOGIN',
    'GetType',
    'normal',
    'innerSubKey',
    'Bin_CFile',
    'Bin_Editfile',
    'LinkLayerType',
    'RemotePort',
    'GetProcesses',
    'Bin_Style_Login',
    'RemoteAddress',
    'ServerIP',
    'PathName',
    'Double',
    'SETDOMAIN',
    'Int64',
    'Label1',
    'packetData',
    'Address',
    'valign',
    'Bin_main',
    'Position',
    'CmdShell',
    'W3SVC',
    'GetLastWriteTime',
    'CreateObject',
    'dbname',
    'OnCheckedChanged',
    'binftp',
    'dirstr',
    'showatt',
    'space',
    'HostName',
    'LogFile',
    'OleDbSchemaGuid',
    'Threads',
    'FromBase64String',
    'GetOleDbSchemaTable',
    'PortScan',
    'SOFTWARE',
    'Matches',
    'operation',
    'Hide_Div',
    'getpath',
    'iisend',
    'AnonymousUserName',
    'scanres',
    'tnQRF',
    'existdir',
    'ListBox5',
    'HTTP_X_FORWARDED_FOR',
    'urldecode',
    'server_name',
    'varchar',
    'vbcrlf',
    'logIt',
    'Label2',
    'file_name',
    'iisstart',
    'PortMap',
    'mWGEm',
    'sqlname',
    'fileObject',
    'Paste',
    'unknown',
    'Drives',
    'Services',
    'msxsl',
    'SERVER_SOFTWARE',
    'YFcNP',
    'ports',
    'forms',
    'Rport',
    'Documents',
    'Abandon',
    'HttpCookie',
    'XP_dirtree',
    'RegShell',
    'cutboard',
    'lRavM',
    'strQuery',
    'Terminal',
    'openrowset',
    'TdgGU',
    'baseStream',
    'throw',
    'HczyN',
    '_timeSpent',
    'zKvOw',
    'ZhWSK',
    'kDgkX',
    '120px',
    'FgzeQ',
    'Dstog',
    'VisualBasic',
    'uXevN',
    'lFAvw',
    'Closed',
    'IPAddress',
    'loadpath',
    'lblInfo',
    'oZnZV',
    'nGroup',
    'iDgmL',
    'FTBtf',
    'mtoJb',
    'procedures',
    'ArraySegment',
    'SessionName',
    'aYRwo',
    'pathfile',
    'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',
    'hOWTm',
    'MyFileStream',
    'dbporta',
    'check',
    'getdataport',
    'lblStatus',
    'vbnewline',
    'objProcessInfo',
    'Bin_ReadOnlyCheckBox',
    'Bin_ResLabel',
    'Bin_DriveList',
    'Bin_AccessTimeTextBox',
    'Bin_AccRadioButton',
    'ConnString',
    'vertical',
    'Bin_Filedel',
    'Bin_CreateTextBox',
    'Bin_CreationTimeTextBox',
    'cellContents',
    'jktest',
    'job_name',
    'GetFileSystemEntries',
    'Bin_DirTextBox',
    'nowdir',
    'Win32_Process',
    'processes',
    'Bin_HiddenCheckBox',
    'kusqlpass',
    'kusqlportstr',
    'DriveInfo',
    'winObj',
    'Bin_Option',
    'kusqlname',
    '289px',
    'Bin_Change',
    'subdir',
    'Bin_SystemCheckBox',
    'tblsDt',
    'sqlpass',
    'Bin_ExecButton',
    'ServerBindings',
    'parstr',
    '500px',
    'InfoLabel',
    'Bin_SqlDir',
    'Bin_ArchiveCheckBox',
    'Sqlcmd',
    'Fields_to_Show',
    'Bin_SQLconnTextBox',
    'Bin_LastWriteTimeTextBox',
    'lport',
    'HeaderText',
    'Fields_to_load',
    'RunTable',
    'copystr',
    'copyto',
    'ProtocolType',
    'AddressFamily',
    'InterNetwork',
    '200px',
    'Manager',
    'IsPostBack',
    'xtype',
    'SocketType',
    'monospace',
    'lportC',
    'outstr',
    'sqlEx',
    'packets',
    'HARDWARE',
    'IIsWebVirtualDir',
    'deldir',
    'db_conn',
    'Client',
    'Logout',
    'AddressList',
    'uname',
    'ManagementObject',
    'CIMV2',
    'octet',
    'filecontent',
    'absolute',
    'is_file',
    'elements',
    'bportC',
    'object_id',
    'dbport',
    'cursor',
    'Bin_Createdir',
    'dbpass',
    'Courier',
    'WinNT',
    'Xp_Regwrite',
    'running',
    'event',
    'SYSDATABASES',
    'kusqlport',
    'Bin_Span_Drv',
    'network',
    'ChangeDatabase',
    'jkregstr',
    'regstr',
    'EventHandler',
    'fail_description',
    'thisfile',
    'the_StartInfo',
    'RedirectStandardError',
    'Webshell',
    'thatfile',
    'dddddd',
    'TC_USER',
    'CurrentControlSet',
    'oregstr',
    'CloseConnection',
    'PMCacheName',
    's_inf',
    'PreRender',
    '759px',
    'Settings',
    'sqlshow',
    'Copyright',
    'Scanner',
    'base64String',
    'CurrentPageIndex',
    'filed',
    'PropertyValueCollection',
    'Refresh',
    'SocketException',
    'PhysicalPath',
    'mycon',
    'Equals',
    'Button1',
    'NewLine',
    'BeginSend',
    'SCRIPT_NAME',
    'CentralProcessor',
    'CanWrite',
    'dpath',
    'bbbbbb',
    'SqlException',
    'GetLastWriteTimeUtc',
    'GetLastAccessTimeUtc',
    'Bin_Data',
    'HtmlEncode',
    'Bin_List_DB',
    'RegisterHiddenField',
    'MACAddress',
    'Priority',
    'PropertyData',
    'PropertyDataCollection',
    'PropertyDataEnumerator',
    'getElementsByTagName',
    'Bin_Span_FrameVersion',
    'ColumnSpan',
    'SetLastWriteTimeUtc',
    'created',
    'BeginConnect',
    'zcg_WmiDataTable',
    'Bin_H2_Mac',
    'eventArgument',
    'Hashtable',
    'Bin_Button_KillMe',
    'SetCreationTimeUtc',
    'spath',
    'eventTarget',
    '333333',
    'IIS_USER',
    'Bin_Button_CreateFile',
    'GetCreationTimeUtc',
    'Bin_Button_CreateDir',
    'PagerStyle',
    'EndSend',
    'ThreadCount',
    'EndReceive',
    'SetLastAccessTimeUtc',
    'ServiceController',
    'LastWriteTimeUtc',
    'Bin_Ul_Sys',
    'Bin_Ul_NetConfig',
    'Bin_Ul_Driver',
    'MD5Pass',
    'Bin_H2_Driver',
    'StartMode',
    'Bin_RegresLabel',
    'https',
    'TimeSpan',
    'EndsWith',
    'underline',
    'RedirectStandardInput',
    'Bin_Span_Sname',
    'Bin_SuresLabel',
    'MaxCount',
    'ShowFolders',
    'FormsAuthentication',
    'selectedIndex',
    'formatfile',
    'RunCmd',
    'HashPasswordForStoringInConfigFile',
    'IISversion',
    'jkstream',
    'kbconn',
    'disabled',
    'Demand',
    'ItemArray',
    'IsUserTable',
    'deldomain',
    'Label_Info',
    'xdateformat',
    'WriteFile',
    'lastvalue',
    'IpParts2',
    'ListBox1',
    'intext',
    'DataField',
    'the_rar',
    'Bin_UpFile',
    'inline',
    'strlen',
    'strIPAddr',
    'Lucida',
    'mainSocket',
    'sql_dir',
    '888px',
    'resultbox',
    'separator',
    'Restr',
    'oFile',
    'pconn',
    'oportstr',
    'Bin_EditpathTextBox',
    'Bin_EditTextBox',
    'Bin_AccinfoLabel',
    'getdrname',
    'pcount',
    'changedata',
    'Millseconds',
    'reglaststr',
    'Bin_FileRN',
    'getdelneiku',
    'cboSps',
    'HorizontalAlign',
    'Bin_ScanresLabel',
    'HeaderStyle',
    'Bin_FilelistLabel',
    'MoveNext',
    'renamedir',
    'Resolve',
    'postdata',
    'checker',
    'agentcmd',
    'CheckIsNumber',
    'Head1',
    'GridLines',
    'OBJECTPROPERTY',
    'htmlend',
    'conns',
    'getname',
    'getzhi',
    'Bin_CmdLabel',
    'HHzcY',
    'HideHidden',
    'LoginMesFile',
    'Sumbit',
    'powershell',
    'PasswordType',
    'equiv',
    'Expire',
    'BinaryWrite',
    'owner',
    'TZOEnable',
    'TZOKey',
    'ChangePassword',
    'enabled',
    'WebClient',
    'NeedSecure',
    'DELETEDOMAIN',
    'Keyword',
    '0000FF',
    'Disable',
    'NoneRN',
    'LocalAdministrator',
    'Fixed',
    'ReceiveBufferSize',
    'QuotaCurrent',
    'bytes',
    'CanRead',
    'MaxNrUsers',
    'IdleTimeOut',
    'SessionTimeOut',
    'REMOTE_ADDR',
    'Regular',
    'AlwaysAllowLogin',
    'SETUSERSETUP',
    'MaxUsersLoginPerIP',
    'HomeDir',
    'SpeedLimitDown',
    'SpeedLimitUp',
    'RatiosCredit',
    'Ratios',
    'RelPaths',
    'RWAMELCDP',
    'RatioDown',
    'QuotaEnable',
    'QuotaMaximum',
    'raquo',
    'UDLvA',
    'Starts',
    'lRfRj',
    'PcAnywhere',
    'mHbjB',
    'lDODR',
    'dfile',
    'ADSPath',
    'EnableViewStateMac',
    'vJNsE',
    'vNCHZ',
    'SelectQuery',
    'dbhost',
    'myStreamReader',
    'lbjLD',
    'Renamed',
    'dtFields',
    'dbuser',
    'stNPw',
    'Cancel',
    'ADCpk',
    'XXrLw',
    'dNohJ',
    'ORUgV',
    'iiGFO',
    'iLVUT',
    'ArgumentOutOfRangeException',
    'Bin_Parent',
    'nxeDR',
    'tIykC',
    'IKjwH',
    'Bin_Button_Driv',
    'ToUpper',
    'time1',
    'PhQTd',
    'txtDatabase',
    'DGCoW',
    'outType',
    'CmdPath',
    'fhAEn',
    'txtPassword',
    'Bin_FromBase64',
    'time2',
    'myread',
    'Runtime',
    'xfileperms',
    'nbyte',
    'xparentfolder',
    'thePath',
    'FromDateTime',
    'xplog70',
    'SRVROLEMEMBER',
    'stoptime',
    'copydir',
    'IS_SRVROLEMEMBER',
    'sysadmin',
    '600px',
    'DIFFERENTIAL',
    'outputfile',
    'InteropServices',
    '65500',
    'literal',
    'GetStartedTime',
    'gb2312',
    'no_truncate',
    'LbReg',
    'WebAdmin',
    'tblbox',
    'IS_MEMBER',
    'odsole70',
    'UserInfo',
    'HTTP_HOST',
    'jkkudr',
    'gridResults',
    'Entries',
    'deldr',
    'connku',
    'getwz',
    'dData',
    'editpath',
    'ClearHeaders',
    'dbcmda',
    'exist',
    'ExpandDepth',
    'getattstr',
    'getIP',
    'gridParameters',
    'getself',
    'NewName',
    'xexistdir',
    'myscanner',
    'PortNumber',
    'local_copy_of_cmd',
    'jksdr',
    'PRIMARY',
    'ThreadStart',
    'TreeNodeEventArgs',
    'Login_click',
    'woanware',
    'webname',
    'middle',
    '114px',
    'rdpwd',
    'agentdr',
    'refilename',
    'STYLE1',
    'AnonymousUserPass',
    '194px',
    'zcg_lbtnADS_Click',
    'Notice',
    'txtSqlcmd',
    'OnSelectedNodeChanged',
    'OnTreeNodeExpanded',
    'Operate',
    '312px',
    'btnExecute_Click',
    'txtcommand2',
    'shellcmd',
    'kProcessStartInfo',
    '147px',
    'kProcess',
    'kname',
    'account',
    'sql_query',
    'txtCommand1',
    'TimeZone',
    'Capacity',
    'kernel32',
    'GetValueNames',
    'DropDownList2',
    'Inetsrv',
    'SuExp',
    'GetSubKeyNames',
    'Collections',
    'FileEdit',
    'UBound',
    '447px',
    'Queries',
    'Anonymous',
    'PacketCaptureWriter',
    'passtext',
    'iframe',
    'byteData',
    'maxPacketLength',
    'portnum',
    'arraynum',
    'xfilesize',
    'ushort',
    'captureTimestamp',
    'ufname',
    'modify',
    'GridView',
    'DB_eString',
    'xfilelastmodified',
    'Local',
    'Remote',
    'ADODB',
    'ListBoxPro',
    'letters',
    'stmrdr',
    'DataCStr',
    'txtAuthKey',
    'Button1_Click',
    'bin_temp',
    'Bin_TextBox_Fp',
    'ToBase64String',
    'context',
    'style2',
    'Win32_UserAccount',
    'SandBoxMode',
    'wrong',
    'DirName',
    '350px',
    'Engines',
    'MemoryStream',
    'CheckAll',
    'tmpNum',
    'baidu',
    'ManagementObjectCollection',
    'DirectoryName',
    'MatchCollection',
    '719BC5',
    'REG_DWORD',
    'uploaded',
    'Bin_BackButton_Click',
    'Bin_AccRadioButton_CheckedChanged',
    'Bin_AttLabel',
    '0x3C256578656375746520726571756573742822422229253E',
    'Bin_BakLog',
    'Begin',
    'Bin_AttPanel',
    'Bin_BDButton_Click',
    '765px',
    'Bin_BakDB',
    'OverWrite',
    'usertabdel',
    '240px',
    '157px',
    'omumastr',
    'onchange',
    'SetLastWriteTime',
    'getqmfilestr',
    'SetLastAccessTime',
    'XmlDocument',
    'WebRoot',
    'ServerComment',
    'output_wmi_function_data',
    'StartIp',
    'Target_copy_of_cmd',
    'SetCreationTime',
    'reglastindex',
    'EndIP',
    'FileMode',
    'getdbstra',
    '68915',
    'getdbstr',
    'Create_table_row_with_supplied_colors',
    'Argument',
    'agentsql',
    'text_to_print',
    'fullpath',
    'Repair',
    'struct',
    'getacctable',
    '129px',
    'Antak',
    'regindex',
    'configfilestr',
    'alignValue',
    'Structure',
    'getlistku',
    '138px',
    'quite',
    'press',
    'getfolderstr',
    'getfindmm',
    'StoredProcedure',
    '760px',
    'getallfilestr',
    'enctype',
    '111111',
    'SA_Exec',
    'GetEnvironmentVariable',
    'Encode',
    'Automation',
    'rowItems',
    'columntype',
    '140px',
    'dbsqlconn',
    'properties_',
    'ddlist',
    'Bin_CopyButton_Click',
    'gettzm',
    'IIS_list_Anon_Name_Pass',
    'Bin_SunameTextBox',
    'Bin_SuexpButton_Click',
    'Bin_SucmdTextBox',
    'Bin_SuButton_Click',
    'Bin_SQLRadioButton_CheckedChanged',
    'Bin_SQLButton_Click',
    'Bin_SetButton_Click',
    'Bin_ScanipTextBox',
    'Bin_ScancmdButton_Click',
    'Bin_Scan',
    'Bin_SbackButton_Click',
    'htmlstr',
    'Bin_SAexecButton_Click',
    'Bin_SACMDButton_Click',
    'Bin_RunButton_Click',
    'Bin_RegreadButton_Click',
    'Bin_RegButton_Click',
    'FileButton_Click',
    'Bin_Process',
    'Bin_PortsTextBox',
    'Bin_PortButton_Click',
    'f1f1f1',
    'TimeLabel',
    'Bin_NewFileButton_Click',
    'Bin_SupassTextBox',
    'Bin_SuportTextBox',
    'Bin_Table_File',
    'jksession',
    'Item_DataBound',
    'Item_Command',
    'txtEndIP',
    'txtDatabaseServer',
    'Lb_msg',
    'tv2str',
    'exesql',
    'txtPorts',
    'Bin_NewdirButton_Click',
    'Bin_ValueTextBox',
    'LoginButton_Click',
    'ToInt32',
    'loginpass',
    'loginuser',
    '395px',
    'LogoutButton_Click',
    'lstRet',
    'MainButton_Click',
    'ToArray',
    'iiswebpath',
    'dataconn',
    'dirpath',
    'Bin_upButton_Click',
    'Bin_LogshellButton_Click',
    'fontColor',
    'the_Process',
    'Bin_CmdShellTextBox',
    'Bin_dbshellButton_Click',
    'Bin_ExecButton_Click',
    'Bin_ErrorLabel',
    'Bin_EditPanel',
    'Bin_EditButton_Click',
    'SQL_SumbitButton_Click',
    'Distributed',
    'Bin_Fileatt',
    'environmentVariables',
    'the_Reg',
    'Bin_listButton_Click',
    'z_index',
    'Bin_CutButton_Click',
    'HARDWARE_INFO',
    'noshade',
    'Bin_DirButton_Click',
    'Bin_DBPage',
    'newdomain',
    'Bin_Filedown',
    'txtUserId',
    'Bin_FileLabel',
    'multipart',
    'mustAdd',
    'destr',
    'txtStartIP',
    'dabaodz',
    'delfolderstr',
    'Bin_KeyTextBox',
    'Bin_FileEdit',
    'Bin_CmdButton_Click',
    'Bin_CmdPathTextBox',
    'Bin_iisLabel',
    'Bin_GoButton_Click',
    'Bin_IISButton_Click',
    'Bin_iisinfo',
    'InvokeMethod',
    'Thanks',
    'Offset',
    'edited_path',
    'example',
    'boxid',
    'Strings',
    'BorderWidth',
    'Label_Drives',
    'Sleep',
    'TextBox_FDName',
    '789px',
    'active',
    'childname',
    'GetWebName',
    'UserDomainName',
    'datas',
    'proException',
    '21232f297a57a5a743894a0e4a801fc3',
    'PropertyNames',
    'Timeout',
    'html_onload',
    'html_script',
    'html_title',
    'window',
    '304px',
    'HttpPostedFile',
    'curfile',
    'nReceived',
    'bContinueCapturing',
    'pointer',
    'Drawing',
    'RegisterStartupScript',
    'fcont',
    'visited',
    'passw',
    'xfileopen',
    'Resume',
    'table_name',
    'html_head',
    'tbody',
    'uploadfile',
    'DBConn',
    'Exploit',
    'Subtract',
    'Cryptography',
    'Connected',
    'Bin_Textarea_Query',
    'IIS_PASS',
    'zcg_MakeADSLinkJs',
    'MySql',
    'Bin_Target',
    'AspCompat',
    'onserverclick',
    'Bin_TextArea_Search',
    'Compression',
    'GetCreationTime',
    'Bin_DataGrid_Wmi',
    'Principal',
    'IPHostEntry',
    'NumericPages',
    'found',
    'seldbname',
    'jk1986',
    '______',
    'IsSqlServer',
    'IsNullOrEmpty',
    'CCCCCC',
    'BorderStyle',
    'dtKeys',
    'resultSQL',
    'Terminate',
    'objectSid',
    'NewRow',
    'SQLExec',
    'ModifyTime',
    'DllImport',
    'FileAccess',
    'ServiceName',
    'DatabaseBackup',
    'Extension',
    'Manufacturer',
    'makewebtask',
    'LoginHours',
    'InputStream',
    'LogBackup',
    'invalid',
    'TrimEnd',
    'txtport',
    'txtpackets',
    'layout',
    'extern',
    'opendatasource',
    'txtlogfile',
    'DownloadFile',
    'DefaultValue',
    'ProcessorNameString',
    'GetEnumerator',
    'Assistant',
    'SubKeyCount',
    'completed',
    'Win32_TimeZone',
    'BasePriority',
    'computer',
    'Win32_Service',
    'Framework',
    'Win32_PhysicalMemory',
    'SandBox',
    'Win32_NetworkAdapterConfiguration',
    'scanned',
    'Win32_BIOS',
    'Win32_SystemDriver',
    'TABLE_CATALOG',
    'EndConnect',
    'TABLE_SCHEMA',
    'FileList',
    'GetServices',
    'TABLE_PROPID',
    'var_value',
    'xfilesave',
    'wBind',
    'zcg_Rename',
    'UPDATE',
    'xfname',
    'xnewfile',
    'downfilestr',
    'xmldoc',
    'xnewconnect',
    'xparsefilesize',
    'tzcode',
    'dirInfo',
    'drive',
    'errReturn',
    'zcg_tbl_ADSViewer',
    'dlink',
    'txtSqlName',
    'xdname',
    'zcg_txbADSPath',
    'xnewchild',
    'zcg_txbADSType',
    'xsldoc',
    'dirstr1',
    'WorkingSet',
    'var_description',
    'xServerIP',
    'dport',
    'WinExec',
    'var_name',
    'xnewfolder',
    'jksend',
    'execution',
    'gmcode',
    'objmanage',
    'oFileSys',
    'oleda',
    'oleds',
    'Order',
    'oScript',
    'osqldatabasestr',
    'osqlnamestr',
    'osqlpassstr',
    'output_wmi_function_data_instances',
    'parentdir',
    'getqmstr',
    'getprocess',
    'pesan',
    'getmmstr',
    'plaste',
    'portarray',
    'getjkdeldomain',
    'getfilex',
    'getfilestr',
    'getfile',
    'providerObj',
    'numDataBytes',
    'nTime',
    'GridView2',
    'nodeObj',
    'iswriteable',
    'LbScan',
    'lbuffer',
    'IpList',
    'ListBox2',
    'Listen',
    'local_dir',
    'localurl',
    'Initial',
    'logNextPacket',
    'iisusername',
    'qmcode',
    'iisdk',
    'MemorySize',
    'htmlspecialchars',
    'minisizepacket',
    'holepath',
    'my_s_ftp',
    'my_s_http_post',
    'my_s_smtp',
    'myTableName',
    'names',
    'netcat',
    'newjc',
    'IIsComputerObj',
    'txtCmdIn',
    'getdelkustr',
    'rbuffer',
    'sutc1',
    'syslog',
    'SystemDirectory',
    'filemtime',
    'filelocal',
    'TableColumn',
    'filego',
    'tblPkName',
    'tblRun',
    'tempDrives',
    'filectime',
    'fileatime',
    'FileAct',
    'TextBox1',
    'TextBoxReadDir',
    'TextBoxRenameTo',
    'the_Info',
    'the_Obj',
    'thisChar',
    'thisData',
    'faction',
    'explorer',
    'TreeView4_SelectedNodeChanged',
    'Surround_by_TD_and_Bold',
    'Surround_by_TD',
    'FileShare',
    'FileUpload1',
    'getdbfileall',
    'Getdbfilea',
    'getcontent',
    'getcfile',
    'regImg',
    'getallstr',
    'RegValue',
    'remoteurl',
    'returns',
    'revstr',
    'fsize',
    'getdelfolder',
    'rowItem',
    's_driver',
    'savefile',
    'ScanPorts',
    'ScanResults',
    'sport',
    'Stack',
    'firstfield',
    'strIP',
    'final',
    'filewant',
    'fileurl',
    'rowspan',
    'directories',
    '_____',
    '381px',
    'center_',
    'cmdw32',
    'cmdwsh',
    'cfile',
    '268px',
    '274px',
    '286px',
    'cfolderstr',
    'CheckBox1',
    'could',
    'BindData',
    'CheckBox2',
    'decimal',
    'CheckBox3',
    'Bin_Table_Reg',
    'AspNetHostingPermission',
    '356px',
    'AspNetHostingPermissionLevel',
    '_Value',
    'curpart',
    'Accounts',
    '003300',
    '595px',
    'catalog',
    'applog',
    'ContentLength',
    'btnLogin',
    'db_cmd',
    'DB_DataGrid',
    'btnLogin_Click',
    'db_ds',
    '211px',
    'Bin_List_SelectedIndexChanged',
    'Bin_List_Connstr',
    'Bin_TextBox_Sp',
    'Bin_TextBox_Sp1',
    'db_schemaTable',
    'ADSSettings',
    'daboml',
    'ADSUserName',
    'cmdshow',
    'dbowner',
    '153px',
    '270px',
    '560px',
    '170px',
    'CommandEventArgs',
    '_CaptureTimestamp',
    '174px',
    '154px',
    'checkname',
    'CheckBox4',
    '_BaseStream',
    '160px',
    '155px',
    'DictionaryEntry',
    '169px',
    'auser',
    'Unknow',
    'OREpx',
    '258px',
    'details',
    'JJjbW',
    'admin',
    'ImportRow',
    'nDrive',
    'RsqhW',
    'ZSnXu',
    'ParseControl',
    'DataGridPageChangedEventArgs',
    'Started',
    'subpath',
    'WriteLine',
    'GetDriveTypeA',
    'VARIABLES',
    'DataTextField',
    'JEaxV',
    'xaGwl',
    'DataAvailable',
    'KHbEd',
    'enter',
    'readreg_Click',
    'EntryPoint',
    'FindControl',
    '666px',
    'PageSize',
    'RegStack',
    'CDRom',
    'JIAKU',
    'CommandEventHandler',
    'wmgnK',
    'OLJFp',
    'CmUCh',
    'Removable',
    'NewPageIndex',
    'permission',
    'QcZPA',
    'baVJV',
    'CompareMethod',
    '950px',
    'Creat',
    'OnPageIndexChanged',
    'JScript',
    'CommandLine',
    'timeSpent'
)

# Define heuristic rules for heuristic analysis
$heuristicRules = @(
    @{ 'pattern' = 'eval\('; 'description' = 'Use of eval function' },
    @{ 'pattern' = 'base64_decode\('; 'description' = 'Use of base64_decode function' },
    @{ 'pattern' = 'shell_exec\('; 'description' = 'Use of shell_exec function' },
    @{ 'pattern' = 'proc_open\('; 'description' = 'Use of proc_open function' },
    @{ 'pattern' = 'popen\('; 'description' = 'Use of popen function' },
    @{ 'pattern' = 'passthru\('; 'description' = 'Use of passthru function' },
    @{ 'pattern' = 'system\('; 'description' = 'Use of system function' },
    @{ 'pattern' = 'exec\('; 'description' = 'Use of exec function' },
    @{ 'pattern' = 'assert\('; 'description' = 'Use of assert function' },
    @{ 'pattern' = 'preg_replace\("/e"'; 'description' = 'Use of preg_replace with /e modifier' },
    @{ 'pattern' = 'create_function\('; 'description' = 'Use of create_function' },
    @{ 'pattern' = 'include\('; 'description' = 'Use of include function' },
    @{ 'pattern' = 'require\('; 'description' = 'Use of require function' },
    @{ 'pattern' = 'include_once\('; 'description' = 'Use of include_once function' },
    @{ 'pattern' = 'require_once\('; 'description' = 'Use of require_once function' },
    @{ 'pattern' = 'file_get_contents\('; 'description' = 'Use of file_get_contents function' },
    @{ 'pattern' = 'fopen\('; 'description' = 'Use of fopen function' },
    @{ 'pattern' = 'fread\('; 'description' = 'Use of fread function' },
    @{ 'pattern' = 'fwrite\('; 'description' = 'Use of fwrite function' },
    @{ 'pattern' = 'curl_exec\('; 'description' = 'Use of curl_exec function' },
    @{ 'pattern' = 'curl_multi_exec\('; 'description' = 'Use of curl_multi_exec function' },
    @{ 'pattern' = 'parse_ini_file\('; 'description' = 'Use of parse_ini_file function' },
    @{ 'pattern' = 'show_source\('; 'description' = 'Use of show_source function' }
    @{ 'pattern' = 'gzinflate\('; 'description' = 'Use of gzinflate function' },
    @{ 'pattern' = 'str_rot13\('; 'description' = 'Use of str_rot13 function' },
    @{ 'pattern' = 'gzuncompress\('; 'description' = 'Use of gzuncompress function' },
    @{ 'pattern' = 'gzdecode\('; 'description' = 'Use of gzdecode function' },
    @{ 'pattern' = 'preg_replace_callback\('; 'description' = 'Use of preg_replace_callback function' },
    @{ 'pattern' = 'call_user_func\('; 'description' = 'Use of call_user_func function' },
    @{ 'pattern' = 'call_user_func_array\('; 'description' = 'Use of call_user_func_array function' },
    @{ 'pattern' = 'array_map\('; 'description' = 'Use of array_map function' },
    @{ 'pattern' = 'array_walk\('; 'description' = 'Use of array_walk function' },
    @{ 'pattern' = 'array_filter\('; 'description' = 'Use of array_filter function' },
    @{ 'pattern' = 'array_reduce\('; 'description' = 'Use of array_reduce function' },
    @{ 'pattern' = 'create_function\('; 'description' = 'Use of create_function function' },
    @{ 'pattern' = 'register_shutdown_function\('; 'description' = 'Use of register_shutdown_function' },
    @{ 'pattern' = 'register_tick_function\('; 'description' = 'Use of register_tick_function' },
    @{ 'pattern' = 'ob_start\('; 'description' = 'Use of ob_start function' },
    @{ 'pattern' = 'ob_get_contents\('; 'description' = 'Use of ob_get_contents function' },
    @{ 'pattern' = 'ob_get_clean\('; 'description' = 'Use of ob_get_clean function' },
    @{ 'pattern' = 'ob_end_clean\('; 'description' = 'Use of ob_end_clean function' },
    @{ 'pattern' = 'ob_flush\('; 'description' = 'Use of ob_flush function' }
    @{ 'pattern' = 'base64_encode\('; 'description' = 'Use of base64_encode function' },
    @{ 'pattern' = 'strrev\('; 'description' = 'Use of strrev function' },
    @{ 'pattern' = 'str_replace\('; 'description' = 'Use of str_replace function' },
    @{ 'pattern' = 'preg_match\('; 'description' = 'Use of preg_match function' },
    @{ 'pattern' = 'preg_split\('; 'description' = 'Use of preg_split function' },
    @{ 'pattern' = 'preg_grep\('; 'description' = 'Use of preg_grep function' },
    @{ 'pattern' = 'preg_filter\('; 'description' = 'Use of preg_filter function' },
    @{ 'pattern' = 'file_put_contents\('; 'description' = 'Use of file_put_contents function' },
    @{ 'pattern' = 'file\('; 'description' = 'Use of file function' },
    @{ 'pattern' = 'readfile\('; 'description' = 'Use of readfile function' },
    @{ 'pattern' = 'unlink\('; 'description' = 'Use of unlink function' },
    @{ 'pattern' = 'rename\('; 'description' = 'Use of rename function' },
    @{ 'pattern' = 'copy\('; 'description' = 'Use of copy function' },
    @{ 'pattern' = 'move_uploaded_file\('; 'description' = 'Use of move_uploaded_file function' },
    @{ 'pattern' = 'chmod\('; 'description' = 'Use of chmod function' },
    @{ 'pattern' = 'chown\('; 'description' = 'Use of chown function' },
    @{ 'pattern' = 'chgrp\('; 'description' = 'Use of chgrp function' },
    @{ 'pattern' = 'touch\('; 'description' = 'Use of touch function' },
    @{ 'pattern' = 'header\('; 'description' = 'Use of header function' },
    @{ 'pattern' = 'setcookie\('; 'description' = 'Use of setcookie function' },
    @{ 'pattern' = 'session_start\('; 'description' = 'Use of session_start function' },
    @{ 'pattern' = 'session_destroy\('; 'description' = 'Use of session_destroy function' },
    @{ 'pattern' = 'session_regenerate_id\('; 'description' = 'Use of session_regenerate_id function' },
    @{ 'pattern' = 'ini_set\('; 'description' = 'Use of ini_set function' },
    @{ 'pattern' = 'ini_get\('; 'description' = 'Use of ini_get function' },
    @{ 'pattern' = 'putenv\('; 'description' = 'Use of putenv function' },
    @{ 'pattern' = 'getenv\('; 'description' = 'Use of getenv function' },
    @{ 'pattern' = 'mail\('; 'description' = 'Use of mail function' },
    @{ 'pattern' = 'mb_send_mail\('; 'description' = 'Use of mb_send_mail function' },
    @{ 'pattern' = 'fsockopen\('; 'description' = 'Use of fsockopen function' },
    @{ 'pattern' = 'pfsockopen\('; 'description' = 'Use of pfsockopen function' },
    @{ 'pattern' = 'stream_socket_client\('; 'description' = 'Use of stream_socket_client function' },
    @{ 'pattern' = 'stream_socket_server\('; 'description' = 'Use of stream_socket_server function' },
    @{ 'pattern' = 'stream_context_create\('; 'description' = 'Use of stream_context_create function' },
    @{ 'pattern' = 'stream_context_set_option\('; 'description' = 'Use of stream_context_set_option function' },
    @{ 'pattern' = 'stream_context_get_options\('; 'description' = 'Use of stream_context_get_options function' },
    @{ 'pattern' = 'stream_filter_append\('; 'description' = 'Use of stream_filter_append function' },
    @{ 'pattern' = 'stream_filter_prepend\('; 'description' = 'Use of stream_filter_prepend function' },
    @{ 'pattern' = 'stream_get_contents\('; 'description' = 'Use of stream_get_contents function' },
    @{ 'pattern' = 'stream_set_blocking\('; 'description' = 'Use of stream_set_blocking function' },
    @{ 'pattern' = 'stream_set_timeout\('; 'description' = 'Use of stream_set_timeout function' },
    @{ 'pattern' = 'stream_set_write_buffer\('; 'description' = 'Use of stream_set_write_buffer function' },
    @{ 'pattern' = 'stream_socket_enable_crypto\('; 'description' = 'Use of stream_socket_enable_crypto function' },
    @{ 'pattern' = 'stream_socket_shutdown\('; 'description' = 'Use of stream_socket_shutdown function' }
    @{ 'pattern' = 'eval\(base64_decode\('; 'description' = 'Use of eval with base64_decode' },
    @{ 'pattern' = 'preg_replace\(.*/e'; 'description' = 'Use of preg_replace with /e modifier' },
    @{ 'pattern' = 'create_function\('; 'description' = 'Use of create_function' },
    @{ 'pattern' = 'assert\('; 'description' = 'Use of assert function' },
    @{ 'pattern' = 'system\('; 'description' = 'Use of system function' },
    @{ 'pattern' = 'shell_exec\('; 'description' = 'Use of shell_exec function' },
    @{ 'pattern' = 'passthru\('; 'description' = 'Use of passthru function' },
    @{ 'pattern' = 'exec\('; 'description' = 'Use of exec function' },
    @{ 'pattern' = 'popen\('; 'description' = 'Use of popen function' },
    @{ 'pattern' = 'proc_open\('; 'description' = 'Use of proc_open function' },
    @{ 'pattern' = 'phpinfo\('; 'description' = 'Use of phpinfo function' },
    @{ 'pattern' = 'get_defined_vars\('; 'description' = 'Use of get_defined_vars function' },
    @{ 'pattern' = 'get_defined_functions\('; 'description' = 'Use of get_defined_functions function' },
    @{ 'pattern' = 'get_included_files\('; 'description' = 'Use of get_included_files function' },
    @{ 'pattern' = 'get_required_files\('; 'description' = 'Use of get_required_files function' },
    @{ 'pattern' = 'getenv\('; 'description' = 'Use of getenv function' },
    @{ 'pattern' = 'putenv\('; 'description' = 'Use of putenv function' },
    @{ 'pattern' = 'extract\('; 'description' = 'Use of extract function' },
    @{ 'pattern' = 'parse_str\('; 'description' = 'Use of parse_str function' },
    @{ 'pattern' = 'mb_ereg_replace\(.*/e'; 'description' = 'Use of mb_ereg_replace with /e modifier' },
    @{ 'pattern' = 'mb_eregi_replace\(.*/e'; 'description' = 'Use of mb_eregi_replace with /e modifier' },
    @{ 'pattern' = 'call_user_func\('; 'description' = 'Use of call_user_func function' },
    @{ 'pattern' = 'call_user_func_array\('; 'description' = 'Use of call_user_func_array function' },
    @{ 'pattern' = 'ReflectionFunction\('; 'description' = 'Use of ReflectionFunction' },
    @{ 'pattern' = 'ReflectionMethod\('; 'description' = 'Use of ReflectionMethod' },
    @{ 'pattern' = 'ReflectionClass\('; 'description' = 'Use of ReflectionClass' },
    @{ 'pattern' = 'ReflectionObject\('; 'description' = 'Use of ReflectionObject' },
    @{ 'pattern' = 'ReflectionProperty\('; 'description' = 'Use of ReflectionProperty' },
    @{ 'pattern' = 'ReflectionParameter\('; 'description' = 'Use of ReflectionParameter' },
    @{ 'pattern' = 'ReflectionExtension\('; 'description' = 'Use of ReflectionExtension' },
    @{ 'pattern' = 'ReflectionZendExtension\('; 'description' = 'Use of ReflectionZendExtension' }
)

# Calculate the entropy of a given string
function Get-Entropy {
    param(
        [Parameter(Mandatory=$true, Position=0)] [string] $String
    )

    $length = $String.Length
    $symbolFrequency = @{}
    foreach ($symbol in $String.ToCharArray()) {
        if ($symbolFrequency.ContainsKey($symbol)) {
            $symbolFrequency[$symbol]++
        } else {
            $symbolFrequency.Add($symbol, 1)
        }
    }

    $entropy = 0
    $symbolFrequency.Values | foreach {
        $freq = $_ / $length
        $entropy -= $freq * [Math]::Log($freq, 2)
    }

    return $entropy
}

function Detect-WebshellPatterns {
    param(
        [Parameter(Mandatory=$true)] [string] $FileContent
    )

    $matchedPatterns = @()

    foreach ($pattern in $suspiciousPatterns) {
        if ($FileContent -match $pattern) {
            $matchedPatterns += $pattern
        }
    }

    return $matchedPatterns
}

function Perform-HeuristicAnalysis {
    param(
        [Parameter(Mandatory=$true)] [string] $FileContent
    )

    $matchedHeuristics = @()

    foreach ($rule in $heuristicRules) {
        if ($FileContent -match $rule.pattern) {
            $matchedHeuristics += $rule.description
        }
    }

    return $matchedHeuristics
}

function Create-ResultObject {
    param(
        [string] $path,
        [double] $entropy,
        [double] $sdForExt,
        [string] $hash,
        [string] $lastModified,
        [string] $detectionMethod,
        [double] $confidenceScore,
        [array] $matchedPatterns = @(),
        [array] $matchedHeuristics = @()
    )

    $result = New-Object PSObject -Property @{
        'FilePath' = $path
        'Entropy' = $entropy
        'StDev' = $sdForExt
        'Hash' = $hash
        'LastModified' = $lastModified
        'DetectionMethod' = $detectionMethod
        'ConfidenceScore' = $confidenceScore
    }

    if ($matchedPatterns.Count -gt 0) {
        $result | Add-Member -MemberType NoteProperty -Name 'suspiciousKeywords' -Value ($matchedPatterns -join ', ')
    }

    if ($matchedHeuristics.Count -gt 0) {
        $result | Add-Member -MemberType NoteProperty -Name 'matchedHeuristics' -Value ($matchedHeuristics -join ', ')
    }

    return $result
}

function Adjust-ConfidenceScore {
    param(
        [double] $baseScore,
        [array] $matchedPatterns,
        [array] $matchedHeuristics
    )

    $confidenceScore = $baseScore * 100

    if ($matchedPatterns.Count -gt 0) {
        $scoreAdjustment = 0.25 * $matchedPatterns.Count
        $confidenceScore += $scoreAdjustment * 100
    }

    if ($matchedHeuristics.Count -gt 0) {
        $scoreAdjustment = 0.25 * $matchedHeuristics.Count
        $confidenceScore += $scoreAdjustment * 100
    }

    if ($confidenceScore -gt 100) { $confidenceScore = 100 }

    return $confidenceScore
}

function Process-File {
    param(
        [hashtable] $file,
        [string] $detectionMethod,
        [double] $baseScore,
        [double] $sdForExt = $null
    )

    $entropy = $file['Entropy']
    $path = $file['Path']
    $hash = $file['Hash']
    $extension = [System.IO.Path]::GetExtension($path)
    
    if (Test-Path $path) {
        $lastModified = (Get-Item $path).LastWriteTime.ToString("yyyy-MM-ddTHH:mm:ssZ")
        $content = Get-Content $path -Raw -ErrorAction SilentlyContinue
    } else {
        $lastModified = ""
        $content = ""
    }

    if (-not [string]::IsNullOrEmpty($content)) {
        $matchedPatterns = Detect-WebshellPatterns -FileContent $content
        $matchedHeuristics = Perform-HeuristicAnalysis -FileContent $content
        $confidenceScore = Adjust-ConfidenceScore -baseScore $baseScore -matchedPatterns $matchedPatterns -matchedHeuristics $matchedHeuristics

        $result = Create-ResultObject -path $path -entropy $entropy -sdForExt $sdForExt -hash $hash -lastModified $lastModified -detectionMethod $detectionMethod -confidenceScore $confidenceScore -matchedPatterns $matchedPatterns -matchedHeuristics $matchedHeuristics

        $result | ConvertTo-Json -Compress
    } else {
        Write-Verbose "Skipping file $path as it could not be read."
    }
}

# Directories to scan
$DirectoryPaths = @('C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\oab','C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\','C:\inetpub\wwwroot') 

# Directories to exclude
$excludePaths = @('C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\15.1.1713\scripts','C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\Current\scripts\premium','C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\Current\scripts\','C:\Windows\WinSxS','C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\Owa\Current2\version\debug\scripts\','C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\ecp\Current\scripts\')

# File hashes to ignore. If the list is too long, use the txt file next.
$ignoreHashes = @('FE3F0B4326FF9754CB8B61AA3CEFB465A5308658064EE51C41B0A8B50027728D','B6675117A7B174C3AA2510DDDEFF4221BA6E31005333F47C7239ED5D055BBBDD', '54EFA324203B762A03033879057F8A9DB0F7B45C83C8E1A40529CAFF1EB18004','71FE41C6CCB0023576483A1C89929255480A4F5F0F07CFF9A8D2030ECF70E7AE')

# Path to a txt file containing hashes to ignore
$ignoreHashesFilePath = Join-Path $PSScriptRoot "ignore.txt"

if (-not (Test-Path $ignoreHashesFilePath)) {
    New-Item -ItemType File -Path $ignoreHashesFilePath -Force
}

$fileHashes = Get-Content $ignoreHashesFilePath

if ($fileHashes) {
    $ignoreHashes = $fileHashes
}

$webshellFound = $false
$allEntropies = @()
$allFiles = @()
$entropiesPerExtension = @{}
$potentialWebshells = 0
$totalFilesScanned = 0
$scanStartTime = Get-Date

Write-Verbose "Gathering entropies from specified files..."
foreach ($DirectoryPath in $DirectoryPaths) {
    if ($DirectoryPath -notin $excludePaths) {
        Get-ChildItem $DirectoryPath -Recurse -File | Where-Object { $_.Extension -in $fileExtensions.Keys } | ForEach-Object {
            $content = [System.IO.File]::ReadAllText($_.FullName)
            if (-not [string]::IsNullOrEmpty($content)) {
                $entropy = Get-Entropy -String $content
                $hash = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
                $extension = $_.Extension

                # Add the entropy to the corresponding extension's list
                if (-not $entropiesPerExtension.ContainsKey($extension)) {
                    $entropiesPerExtension[$extension] = @()
                }
                $entropiesPerExtension[$extension] += $entropy

                $fileInfo = @{
                    'Path' = $_.FullName
                    'Entropy' = $entropy
                    'Hash' = $hash
                }
                $allFiles += $fileInfo
                $totalFilesScanned++
            } else {
                Write-Verbose "Skipping file $($_.FullName) as it could not be read."
            }
        }
    }
}

$statsPerExtension = @{}

foreach ($extension in $entropiesPerExtension.Keys) {
    $entropies = $entropiesPerExtension[$extension]
    Write-Verbose "Calculating mean entropy for $extension files..."
    $meanEntropy = ($entropies | Measure-Object -Sum).Sum / $entropies.Count
    $squaredDifferences = $entropies | ForEach-Object {
        $difference = $_ - $meanEntropy
        return [Math]::Pow($difference, 2)
    }
    $meanOfSquaredDifferences = ($squaredDifferences | Measure-Object -Sum).Sum / $squaredDifferences.Count
    Write-Verbose "Calculating standard deviation for entropy of $extension files..."
    $sdEntropy = [Math]::Sqrt($meanOfSquaredDifferences)

    $statsPerExtension[$extension] = @{
        'Mean' = $meanEntropy
        'StandardDeviation' = $sdEntropy
    }
}
$x = 2

Write-Verbose "Performing entropy-based detection..."

foreach ($file in $allFiles) {
    $result = Process-File -file $file -detectionMethod "Entropy-based" -baseScore $weights["Entropy-based"]
    if ($result) {
        $webshellFound = $true
        $potentialWebshells++
        Write-Output $result
    }
}

Write-Verbose "Performing standard deviation-based detection..."
foreach ($file in $allFiles) { 
    $extension = [System.IO.Path]::GetExtension($file['Path'])
    $sdForExt = $statsPerExtension[$extension]['StandardDeviation']
    Process-File -file $file -detectionMethod "Standard Deviation-based" -baseScore $weights["Standard Deviation-based"] -sdForExt $sdForExt
}

Write-Verbose "Performing mixed mode detection..."
foreach ($file in $allFiles) {
    $extension = [System.IO.Path]::GetExtension($file['Path'])
    $sdForExt = $statsPerExtension[$extension]['StandardDeviation']
    Process-File -file $file -detectionMethod "Mixed Mode" -baseScore $weights["Mixed Mode"] -sdForExt $sdForExt
}

Write-Verbose "Performing heuristic-based detection..."

foreach ($file in $allFiles) {
    $result = Process-File -file $file -detectionMethod "Heuristic-based" -baseScore $weights["Heuristic-based"]
    if ($result) {
        $webshellFound = $true
        $potentialWebshells++
        Write-Output $result
    }
}

if (-not $webshellFound) {
    Write-Output "No potential web shells detected."
}

$scanEndTime = Get-Date
$scanDuration = $scanEndTime - $scanStartTime
$scanStats = @{
    'TotalFilesScanned' = $totalFilesScanned
    'PotentialWebshells' = $potentialWebshells
    'ScanDuration' = $scanDuration
}

Write-Output "Scan completed. Statistics:"
Write-Output $scanStats | ConvertTo-Json -Compress