ShellSweepPlus.lua

--[[
ShellSweepPlus.lua
authors: Michael Haag

This script is part of the ShellSweepPlus suite, designed to detect potential webshells and other malicious scripts within a given set of directories. It performs various types of analysis, including entropy-based, standard deviation-based, mixed mode, and heuristic-based detection methods.

Key Features:
1. **Entropy-Based Detection**: Calculates the entropy of file contents to identify anomalies.
2. **Standard Deviation-Based Detection**: Uses statistical analysis to detect deviations from normal file behavior.
3. **Mixed Mode Detection**: Combines standard deviation thresholds with hard-coded values for more robust detection.
4. **Heuristic-Based Detection**: Scans for suspicious patterns and known malicious code snippets.
5. **Configurable Parameters**: Allows customization of file extensions, entropy thresholds, and suspicious patterns.
6. **Exclusion and Ignore Lists**: Supports directories and file hashes to be excluded from the scan.

Usage:
- Define the directories to scan and exclude.
- Customize the file extensions and their respective entropy thresholds.
- Add or modify suspicious patterns for heuristic analysis.
- Run the script to perform a comprehensive scan and output the results.

This script is intended for cybersecurity professionals and system administrators to enhance their web security measures by identifying and mitigating potential threats.
]]

print([[
          _____        ________  _          _ _                   _   ____             _            
         |_   _|__    / / ___\ \| |__   ___| | |   __ _ _ __   __| | | __ )  __ _  ___| | __        
  _____    | |/ _ \  | |\___ \| | '_ \ / _ \ | |  / _` | '_ \ / _` | |  _ \ / _` |/ __| |/ /  _____ 
 |_____|   | | (_) | | | ___) | | | | |  __/ | | | (_| | | | | (_| | | |_) | (_| | (__|   <  |_____|
           |_|\___/  | ||____/| |_| |_|\___|_|_|  \__,_|_| |_|\__,_| |____/ \__,_|\___|_|\_\        
                      \_\    /_/                                                                    
                 ____  _          _ _ ____                         ____  _                          
                / ___|| |__   ___| | / ___|_      _____  ___ _ __ |  _ \| |_   _ ___                
                \___ \| '_ \ / _ \ | \___ \ \ /\ / / _ \/ _ \ '_ \| |_) | | | | / __|               
                 ___) | | | |  __/ | |___) \ V  V /  __/  __/ |_) |  __/| | |_| \__ \               
                |____/|_| |_|\___|_|_|____/ \_/\_/ \___|\___| .__/|_|   |_|\__,_|___/               
                                                            |_|                                     
]])
-- Define entropy thresholds and operations for each file extension
local fileExtensions = {
    ['.asp'] = {
        { operation = 'lt', value = 0.805376867704514 },
        { operation = 'gt', value = 5.51268104400858 }
    },
    ['.ashx'] = {
        { operation = 'gt', value = 3.75840459657413 }
    },
    ['.asax'] = {
        { operation = 'gt', value = 3.7288741494524 }
    },
    ['.jspx'] = {
        { operation = 'gt', value = 4.87651397975203 }
    },
    ['.html'] = {
        { operation = 'gt', value = 4.8738392644771 }
    },
    ['.lua'] = {
        { operation = 'gt', value = 4.15186444439319 }
    },
    ['.php'] = {
        { operation = 'gt', value = 4.23015141285636 }
    },
    ['.jsp'] = {
        { operation = 'gt', value = 4.40958415652662 }
    },
    ['.js'] = {
        { operation = 'gt', value = 4.25868439013462 }
    }
}

-- Define suspicious patterns for static code analysis
local suspiciousPatterns = {
    'server',
    'String',
    'DeflateStream',
    'runat',
    'width',
    'eval',
    'base64_decode',
    'exec',
    'shell_exec',
    'passthru',
    'system',
    'popen',
    'proc_open',
    'false',
    'Value',
    'style',
    'Visible',
    'ToString',
    'Response',
    'PUBLIC',
    'TableCell',
    'table',
    'TextBox',
    'Write',
    'Request',
    'object',
    'protected',
    'sender',
    'System',
    'align',
    'onclick',
    'catch',
    'EventArgs',
    'height',
    'input',
    'Exception',
    'return',
    'class',
    'ERROR',
    'Button',
    'color',
    'Label',
    'script',
    'center',
    'Message',
    'CssClass',
    'border',
    'Controls',
    'Replace',
    'fileName',
    'TableRow',
    'Length',
    'Session',
    'Namespace',
    'Import',
    'Attributes',
    'Close',
    'ListItem',
    'instr',
    'DataTable',
    'select',
    'directory',
    'action',
    'function',
    'Checked',
    'Count',
    'xseuB',
    'break',
    'foreach',
    'LinkButton',
    'margin',
    'private',
    'javascript',
    'solid',
    'ServerVariables',
    'Cells',
    'QueryString',
    'EnableViewState',
    'Append',
    'className',
    'title',
    'Items',
    'Panel',
    'Bin_Files',
    'Process',
    'Parse',
    'AXSbb',
    '100px',
    'innerText',
    'SqlCommand',
    'Dispose',
    'TreeNode',
    'encoding',
    'cellspacing',
    'colspan',
    'command',
    'background',
    'Result',
    'Password',
    'Bin_PostBack',
    'alert',
    'SqlConnection',
    'Substring',
    'Registry',
    'Database',
    'Bin_DataGrid',
    'FileInfo',
    'Bin_H2_Title',
    'default',
    'Version',
    'Properties',
    'DirectoryInfo',
    'IndexOf',
    'SelectedItem',
    'Empty',
    'padding',
    'Success',
    'UrlEncode',
    'Hidden',
    'master',
    'InnerHtml',
    'CheckBox',
    'target',
    'delete',
    'DirectoryEntry',
    'Focus',
    'CellPadding',
    'Environment',
    'Reg_Path',
    'Bin_Error',
    'submit',
    'WICxe',
    'onmouseover',
    'DropDownList',
    'location',
    'StartInfo',
    'FileAttributes',
    'Columns',
    'StreamWriter',
    'onmouseout',
    'Bin_FileList',
    'Query',
    'MapPath',
    'Content',
    'regkey',
    'right',
    'DataGridItem',
    'Buffer',
    'XP_CmdShell',
    'Regex',
    'OpenSubKey',
    'Exists',
    'Stream',
    'child',
    'DataBind',
    'Bin_Request',
    'TcpClient',
    'FileSize',
    'CommandType',
    'error_x',
    'FullName',
    'datetime',
    'ByVal',
    'INDEX',
    'StreamReader',
    'Microsoft',
    'Language',
    'Convert',
    'Start',
    'bin_cmd',
    'fname',
    'filepath',
    'StringBuilder',
    'textarea',
    'SetAttributes',
    'GetAttributes',
    'DB_NAME',
    'Split',
    'Tables',
    'fpath',
    'ForeColor',
    'newdir',
    'Execute',
    'option',
    'RegistryKey',
    'Bin_upTextBox',
    'LastIndexOf',
    'bottom',
    'SelectedNode',
    'decoration',
    'create',
    'xcleanpath',
    'DataSet',
    'ReadOnly',
    'sp_configure',
    'RECONFIGURE',
    'getall',
    'buttom',
    'clear',
    'UEbTI',
    'rename',
    'Upload',
    '_blank',
    'float',
    'Shell',
    'Int32',
    'Transitional',
    'sqlstr',
    'tblname',
    'contents',
    'declare',
    'Format',
    'param',
    'static',
    'ReadToEnd',
    'StartsWith',
    'instream',
    'Nodes',
    'getocmd',
    'Bin_folder',
    'Socket',
    'Bin_path',
    'xhtml1',
    'goaction',
    'Assembly',
    'strResult',
    'SelectedValue',
    'DataSource',
    'XHTML',
    'ElseIf',
    'Arguments',
    'Culture',
    'OleDbConnection',
    'neutral',
    'PublicKeyToken',
    'AutoPostBack',
    'tmpstr',
    'GetValue',
    'White',
    'Please',
    'ltcpClient',
    'Windows',
    'ExecuteNonQuery',
    'while',
    'AsyncCallback',
    'HKEY_LOCAL_MACHINE',
    'ToLower',
    'Bin_Scroll',
    'GetFileName',
    'SELECTED',
    'B03F5F7F11D50A3A',
    'files',
    'Thread',
    'NVarChar',
    'document',
    'TreeView4',
    'tqstr',
    'AddHeader',
    'history',
    'OleDb',
    'UserName',
    'Bin_DataTable',
    'summary',
    'OleDbDataAdapter',
    'Sp_Oacreate',
    'ToDateTime',
    'Archive',
    'Bin_Action',
    'IpParts1',
    'getselfurl',
    'Bin_DBinfoLabel',
    'Parameters',
    'display',
    'DataGrid',
    '009900',
    'rtcpClient',
    'zcg_ShowError',
    'Cmdpro',
    'State',
    'NetworkStream',
    'rootkey',
    'xfile',
    'mydir',
    'where',
    'TextMode',
    'Charset',
    'MSSQL',
    'CloneTime',
    'Bin_IISPanel',
    'myProcessStartInfo',
    'formatpath',
    '631px',
    'iisinfo',
    'OleDbCommand',
    'Label_Files',
    'Driver',
    'STATUS',
    'subkey',
    'ArrayList',
    'sysname',
    'chkall',
    'rootkit',
    'accstr',
    'Expanded',
    'backup',
    'LocalMachine',
    'prompt',
    'CONNECT',
    'Bin_LoginPanel',
    'Bin_RegPanel',
    'Bin_SQLPanel',
    'Bin_PortPanel',
    'Bin_SuPanel',
    'Bin_CmdPanel',
    'Bin_AccPanel',
    'Bin_DBmenuPanel',
    'Options',
    'confirm',
    'family',
    'IAsyncResult',
    'SocketFlags',
    'iaMKl',
    'Output',
    'recResult',
    '172px',
    'Domain',
    'Bin_dir',
    'Console',
    'Bin_Msg',
    'application',
    '52521',
    'Parent',
    'Children',
    'Access',
    'INSERT',
    'overflow',
    'Remove',
    'weight',
    'folder',
    'Provider',
    'SqlDataAdapter',
    'Cookies',
    'scanport',
    'DirectoryServices',
    'Image',
    'PortForward',
    'prostr',
    'TreeView2',
    'Bin_Table',
    'Bin_file',
    'information',
    'bgcolor',
    'Bin_MenuPanel',
    'Bin_dirPanel',
    'Diagnostics',
    'Upfile',
    'GetFiles',
    'localhost',
    'GetDirectories',
    'CommandText',
    'green',
    'Array',
    'source',
    'xmlns',
    'packet',
    'system32',
    'BackColor',
    'continue',
    'Sysinfo',
    'getspyrootfolder',
    'TreeView3',
    'advanced',
    'Wmi_Function',
    '__EVENTTARGET',
    'DOCTYPE',
    'IsMatch',
    'SqlClient',
    'jXkaE',
    'DPrPL',
    'SQL2005',
    'RaTGr',
    'click',
    'sqlrootkit',
    'Bin_Regread',
    'strValueName',
    'Integer',
    'd_file',
    'Connection',
    'AsyncState',
    'objfile',
    'Users',
    'Bin_FilePanel',
    'tempFile',
    'RadioButton',
    'ContentType',
    'ManagementObjectSearcher',
    'uppath',
    'RegexOptions',
    'myprocess',
    'IgnoreCase',
    'LOCAL_ADDR',
    'SqlDbType',
    'MultiLine',
    'Bin_ExecSql',
    'const',
    'PostedFile',
    'HKEY_CLASSES_ROOT',
    'HKEY_CURRENT_USER',
    'ProcessStartInfo',
    'HKEY_USERS',
    'HKEY_CURRENT_CONFIG',
    'filepath2',
    'RawLength',
    'TreeView5',
    'GetParent',
    'Description',
    '084B8E',
    'foldername',
    'Getparentdir',
    'DropDownList1',
    'switch',
    'program',
    'OnSelectedIndexChanged',
    'FFFFFF',
    'LastWriteTime',
    'Bin_TextBox_Path',
    'ListBox',
    'change',
    'GetString',
    'method',
    'Sendstr',
    'Bin_Listdir',
    'theform',
    'getjkrev',
    'Page_Load',
    'VALUES',
    'ProcessID',
    'BoundColumn',
    'Match',
    'allfile',
    'AUTHKEY',
    'adoConn',
    'vbhLn',
    'UseShellExecute',
    'PATH_TRANSLATED',
    'Tahoma',
    'Params',
    'PhysicalApplicationPath',
    'dAJTD',
    'RedirectStandardOutput',
    'StandardOutput',
    'dQIIF',
    'About',
    'OpenConnection',
    'cmdstr',
    'iisstr',
    'PATH_INFO',
    'ShowError',
    'shell_color',
    'Bin_Databind',
    'Black',
    'ConnectionString',
    'GetBytes',
    'hover',
    'MachineName',
    'TableName',
    'dColumn',
    '000000',
    'BeginReceive',
    'commandargument',
    'newdir1',
    'oEnum',
    'sp_oamethod',
    'Arial',
    'Control',
    'GetLogicalDrives',
    'current',
    'myString',
    'config',
    'newfile',
    'HttpUtility',
    'OSVersion',
    'SaveAs',
    'Security',
    'ServiceProcess',
    'SelectCommand',
    'TEMP2',
    'getElementById',
    'finally',
    'validateRequest',
    'ToolTip',
    '300px',
    'Bin_CopytoTextBox',
    'Login',
    'Bin_SQLRadioButton',
    'form1',
    'modified',
    'patharray',
    'Flush',
    'Disposition',
    '763px',
    'Debug',
    'Bin_DBstrTextBox',
    'Threading',
    'getjksend',
    'attachment',
    'ASPXSpy',
    'acctable',
    '43958',
    'nowrap',
    'ListBox3',
    'fields_split',
    'mysession',
    'getport',
    'FF0000',
    'Bin_Createfile',
    'SqlDataReader',
    'CreateDirectory',
    'RegularExpressions',
    'Maintenance',
    'PortNo',
    'GetStream',
    'zcg_GetTableRow',
    'Sockets',
    'download',
    'tmpbyte',
    'IPEndPoint',
    'sfile',
    'wscript',
    'GridView1',
    'ClassesRoot',
    'ComputerName',
    'FileManager',
    'UnixTime',
    'Caption',
    'ProcessName',
    'Nothing',
    'DdmPl',
    'Search',
    'showfolder',
    'ListBox4',
    'kQmRu',
    'connstr',
    'Redirect',
    'kRXgt',
    'TEMP1',
    'lyTOK',
    'Win32',
    'oJiym',
    'drivers',
    '119px',
    'hwJeS',
    'ljtzC',
    'Bin_Td_Res',
    'ConnectionState',
    'AllowPaging',
    'Verdana',
    'block',
    'HEADER',
    'FileStream',
    'Boolean',
    'FOOTER',
    'PacketCapture',
    'using',
    'addextendedproc',
    'Timestamp',
    'sp_makewebtask',
    'm_Writer',
    'db_owner',
    '0x62696E',
    'GetSize',
    'style3',
    'LastAccessTime',
    'Bin_login',
    'GroupName',
    'DataRow',
    'CreationTime',
    'SQLOLEDB',
    'sysobjects',
    'LocalPort',
    'Localaddress',
    'Clone',
    'ExecuteReader',
    'CurrentUser',
    'Management',
    'IISSpy',
    '__File',
    'mywrite',
    'CurrentConfig',
    'fileconfigpath',
    'strTmp',
    'strong',
    'getfs',
    'Bin_ToBase64',
    'Trace',
    'Bin_MainPanel',
    'TreeView1',
    'Bin_CopyTextBox',
    'db_info',
    'TreeView',
    'SERVER_PORT',
    'Bin_SAexecButton',
    'Bin_Accbind',
    'ASCII',
    'oleconn',
    'typeof',
    'is_dir',
    '150px',
    'ULOGIN',
    'GetType',
    'normal',
    'innerSubKey',
    'Bin_CFile',
    'Bin_Editfile',
    'LinkLayerType',
    'RemotePort',
    'GetProcesses',
    'Bin_Style_Login',
    'RemoteAddress',
    'ServerIP',
    'PathName',
    'Double',
    'SETDOMAIN',
    'Int64',
    'Label1',
    'packetData',
    'Address',
    'valign',
    'Bin_main',
    'Position',
    'CmdShell',
    'W3SVC',
    'GetLastWriteTime',
    'CreateObject',
    'dbname',
    'OnCheckedChanged',
    'binftp',
    'dirstr',
    'showatt',
    'space',
    'HostName',
    'LogFile',
    'OleDbSchemaGuid',
    'Threads',
    'FromBase64String',
    'GetOleDbSchemaTable',
    'PortScan',
    'SOFTWARE',
    'Matches',
    'operation',
    'Hide_Div',
    'getpath',
    'iisend',
    'AnonymousUserName',
    'scanres',
    'tnQRF',
    'existdir',
    'ListBox5',
    'HTTP_X_FORWARDED_FOR',
    'urldecode',
    'server_name',
    'varchar',
    'vbcrlf',
    'logIt',
    'Label2',
    'file_name',
    'iisstart',
    'PortMap',
    'mWGEm',
    'sqlname',
    'fileObject',
    'Paste',
    'unknown',
    'Drives',
    'Services',
    'msxsl',
    'SERVER_SOFTWARE',
    'YFcNP',
    'ports',
    'forms',
    'Rport',
    'Documents',
    'Abandon',
    'HttpCookie',
    'XP_dirtree',
    'RegShell',
    'cutboard',
    'lRavM',
    'strQuery',
    'Terminal',
    'openrowset',
    'TdgGU',
    'baseStream',
    'throw',
    'HczyN',
    '_timeSpent',
    'zKvOw',
    'ZhWSK',
    'kDgkX',
    '120px',
    'FgzeQ',
    'Dstog',
    'VisualBasic',
    'uXevN',
    'lFAvw',
    'Closed',
    'IPAddress',
    'loadpath',
    'lblInfo',
    'oZnZV',
    'nGroup',
    'iDgmL',
    'FTBtf',
    'mtoJb',
    'procedures',
    'ArraySegment',
    'SessionName',
    'aYRwo',
    'pathfile',
    'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',
    'hOWTm',
    'MyFileStream',
    'dbporta',
    'check',
    'getdataport',
    'lblStatus',
    'vbnewline',
    'objProcessInfo',
    'Bin_ReadOnlyCheckBox',
    'Bin_ResLabel',
    'Bin_DriveList',
    'Bin_AccessTimeTextBox',
    'Bin_AccRadioButton',
    'ConnString',
    'vertical',
    'Bin_Filedel',
    'Bin_CreateTextBox',
    'Bin_CreationTimeTextBox',
    'cellContents',
    'jktest',
    'job_name',
    'GetFileSystemEntries',
    'Bin_DirTextBox',
    'nowdir',
    'Win32_Process',
    'processes',
    'Bin_HiddenCheckBox',
    'kusqlpass',
    'kusqlportstr',
    'DriveInfo',
    'winObj',
    'Bin_Option',
    'kusqlname',
    '289px',
    'Bin_Change',
    'subdir',
    'Bin_SystemCheckBox',
    'tblsDt',
    'sqlpass',
    'Bin_ExecButton',
    'ServerBindings',
    'parstr',
    '500px',
    'InfoLabel',
    'Bin_SqlDir',
    'Bin_ArchiveCheckBox',
    'Sqlcmd',
    'Fields_to_Show',
    'Bin_SQLconnTextBox',
    'Bin_LastWriteTimeTextBox',
    'lport',
    'HeaderText',
    'Fields_to_load',
    'RunTable',
    'copystr',
    'copyto',
    'ProtocolType',
    'AddressFamily',
    'InterNetwork',
    '200px',
    'Manager',
    'IsPostBack',
    'xtype',
    'SocketType',
    'monospace',
    'lportC',
    'outstr',
    'sqlEx',
    'packets',
    'HARDWARE',
    'IIsWebVirtualDir',
    'deldir',
    'db_conn',
    'Client',
    'Logout',
    'AddressList',
    'uname',
    'ManagementObject',
    'CIMV2',
    'octet',
    'filecontent',
    'absolute',
    'is_file',
    'elements',
    'bportC',
    'object_id',
    'dbport',
    'cursor',
    'Bin_Createdir',
    'dbpass',
    'Courier',
    'WinNT',
    'Xp_Regwrite',
    'running',
    'event',
    'SYSDATABASES',
    'kusqlport',
    'Bin_Span_Drv',
    'network',
    'ChangeDatabase',
    'jkregstr',
    'regstr',
    'EventHandler',
    'fail_description',
    'thisfile',
    'the_StartInfo',
    'RedirectStandardError',
    'Webshell',
    'thatfile',
    'dddddd',
    'TC_USER',
    'CurrentControlSet',
    'oregstr',
    'CloseConnection',
    'PMCacheName',
    's_inf',
    'PreRender',
    '759px',
    'Settings',
    'sqlshow',
    'Copyright',
    'Scanner',
    'base64String',
    'CurrentPageIndex',
    'filed',
    'PropertyValueCollection',
    'Refresh',
    'SocketException',
    'PhysicalPath',
    'mycon',
    'Equals',
    'Button1',
    'NewLine',
    'BeginSend',
    'SCRIPT_NAME',
    'CentralProcessor',
    'CanWrite',
    'dpath',
    'bbbbbb',
    'SqlException',
    'GetLastWriteTimeUtc',
    'GetLastAccessTimeUtc',
    'Bin_Data',
    'HtmlEncode',
    'Bin_List_DB',
    'RegisterHiddenField',
    'MACAddress',
    'Priority',
    'PropertyData',
    'PropertyDataCollection',
    'PropertyDataEnumerator',
    'getElementsByTagName',
    'Bin_Span_FrameVersion',
    'ColumnSpan',
    'SetLastWriteTimeUtc',
    'created',
    'BeginConnect',
    'zcg_WmiDataTable',
    'Bin_H2_Mac',
    'eventArgument',
    'Hashtable',
    'Bin_Button_KillMe',
    'SetCreationTimeUtc',
    'spath',
    'eventTarget',
    '333333',
    'IIS_USER',
    'Bin_Button_CreateFile',
    'GetCreationTimeUtc',
    'Bin_Button_CreateDir',
    'PagerStyle',
    'EndSend',
    'ThreadCount',
    'EndReceive',
    'SetLastAccessTimeUtc',
    'ServiceController',
    'LastWriteTimeUtc',
    'Bin_Ul_Sys',
    'Bin_Ul_NetConfig',
    'Bin_Ul_Driver',
    'MD5Pass',
    'Bin_H2_Driver',
    'StartMode',
    'Bin_RegresLabel',
    'https',
    'TimeSpan',
    'EndsWith',
    'underline',
    'RedirectStandardInput',
    'Bin_Span_Sname',
    'Bin_SuresLabel',
    'MaxCount',
    'ShowFolders',
    'FormsAuthentication',
    'selectedIndex',
    'formatfile',
    'RunCmd',
    'HashPasswordForStoringInConfigFile',
    'IISversion',
    'jkstream',
    'kbconn',
    'disabled',
    'Demand',
    'ItemArray',
    'IsUserTable',
    'deldomain',
    'Label_Info',
    'xdateformat',
    'WriteFile',
    'lastvalue',
    'IpParts2',
    'ListBox1',
    'intext',
    'DataField',
    'the_rar',
    'Bin_UpFile',
    'inline',
    'strlen',
    'strIPAddr',
    'Lucida',
    'mainSocket',
    'sql_dir',
    '888px',
    'resultbox',
    'separator',
    'Restr',
    'oFile',
    'pconn',
    'oportstr',
    'Bin_EditpathTextBox',
    'Bin_EditTextBox',
    'Bin_AccinfoLabel',
    'getdrname',
    'pcount',
    'changedata',
    'Millseconds',
    'reglaststr',
    'Bin_FileRN',
    'getdelneiku',
    'cboSps',
    'HorizontalAlign',
    'Bin_ScanresLabel',
    'HeaderStyle',
    'Bin_FilelistLabel',
    'MoveNext',
    'renamedir',
    'Resolve',
    'postdata',
    'checker',
    'agentcmd',
    'CheckIsNumber',
    'Head1',
    'GridLines',
    'OBJECTPROPERTY',
    'htmlend',
    'conns',
    'getname',
    'getzhi',
    'Bin_CmdLabel',
    'HHzcY',
    'HideHidden',
    'LoginMesFile',
    'Sumbit',
    'powershell',
    'PasswordType',
    'equiv',
    'Expire',
    'BinaryWrite',
    'owner',
    'TZOEnable',
    'TZOKey',
    'ChangePassword',
    'enabled',
    'WebClient',
    'NeedSecure',
    'DELETEDOMAIN',
    'Keyword',
    '0000FF',
    'Disable',
    'NoneRN',
    'LocalAdministrator',
    'Fixed',
    'ReceiveBufferSize',
    'QuotaCurrent',
    'bytes',
    'CanRead',
    'MaxNrUsers',
    'IdleTimeOut',
    'SessionTimeOut',
    'REMOTE_ADDR',
    'Regular',
    'AlwaysAllowLogin',
    'SETUSERSETUP',
    'MaxUsersLoginPerIP',
    'HomeDir',
    'SpeedLimitDown',
    'SpeedLimitUp',
    'RatiosCredit',
    'Ratios',
    'RelPaths',
    'RWAMELCDP',
    'RatioDown',
    'QuotaEnable',
    'QuotaMaximum',
    'raquo',
    'UDLvA',
    'Starts',
    'lRfRj',
    'PcAnywhere',
    'mHbjB',
    'lDODR',
    'dfile',
    'ADSPath',
    'EnableViewStateMac',
    'vJNsE',
    'vNCHZ',
    'SelectQuery',
    'dbhost',
    'myStreamReader',
    'lbjLD',
    'Renamed',
    'dtFields',
    'dbuser',
    'stNPw',
    'Cancel',
    'ADCpk',
    'XXrLw',
    'dNohJ',
    'ORUgV',
    'iiGFO',
    'iLVUT',
    'ArgumentOutOfRangeException',
    'Bin_Parent',
    'nxeDR',
    'tIykC',
    'IKjwH',
    'Bin_Button_Driv',
    'ToUpper',
    'time1',
    'PhQTd',
    'txtDatabase',
    'DGCoW',
    'outType',
    'CmdPath',
    'fhAEn',
    'txtPassword',
    'Bin_FromBase64',
    'time2',
    'myread',
    'Runtime',
    'xfileperms',
    'nbyte',
    'xparentfolder',
    'thePath',
    'FromDateTime',
    'xplog70',
    'SRVROLEMEMBER',
    'stoptime',
    'copydir',
    'IS_SRVROLEMEMBER',
    'sysadmin',
    '600px',
    'DIFFERENTIAL',
    'outputfile',
    'InteropServices',
    '65500',
    'literal',
    'GetStartedTime',
    'gb2312',
    'no_truncate',
    'LbReg',
    'WebAdmin',
    'tblbox',
    'IS_MEMBER',
    'odsole70',
    'UserInfo',
    'HTTP_HOST',
    'jkkudr',
    'gridResults',
    'Entries',
    'deldr',
    'connku',
    'getwz',
    'dData',
    'editpath',
    'ClearHeaders',
    'dbcmda',
    'exist',
    'ExpandDepth',
    'getattstr',
    'getIP',
    'gridParameters',
    'getself',
    'NewName',
    'xexistdir',
    'myscanner',
    'PortNumber',
    'local_copy_of_cmd',
    'jksdr',
    'PRIMARY',
    'ThreadStart',
    'TreeNodeEventArgs',
    'Login_click',
    'woanware',
    'webname',
    'middle',
    '114px',
    'rdpwd',
    'agentdr',
    'refilename',
    'STYLE1',
    'AnonymousUserPass',
    '194px',
    'zcg_lbtnADS_Click',
    'Notice',
    'txtSqlcmd',
    'OnSelectedNodeChanged',
    'OnTreeNodeExpanded',
    'Operate',
    '312px',
    'btnExecute_Click',
    'txtcommand2',
    'shellcmd',
    'kProcessStartInfo',
    '147px',
    'kProcess',
    'kname',
    'account',
    'sql_query',
    'txtCommand1',
    'TimeZone',
    'Capacity',
    'kernel32',
    'GetValueNames',
    'DropDownList2',
    'Inetsrv',
    'SuExp',
    'GetSubKeyNames',
    'Collections',
    'FileEdit',
    'UBound',
    '447px',
    'Queries',
    'Anonymous',
    'PacketCaptureWriter',
    'passtext',
    'iframe',
    'byteData',
    'maxPacketLength',
    'portnum',
    'arraynum',
    'xfilesize',
    'ushort',
    'captureTimestamp',
    'ufname',
    'modify',
    'GridView',
    'DB_eString',
    'xfilelastmodified',
    'Local',
    'Remote',
    'ADODB',
    'ListBoxPro',
    'letters',
    'stmrdr',
    'DataCStr',
    'txtAuthKey',
    'Button1_Click',
    'bin_temp',
    'Bin_TextBox_Fp',
    'ToBase64String',
    'context',
    'style2',
    'Win32_UserAccount',
    'SandBoxMode',
    'wrong',
    'DirName',
    '350px',
    'Engines',
    'MemoryStream',
    'CheckAll',
    'tmpNum',
    'baidu',
    'ManagementObjectCollection',
    'DirectoryName',
    'MatchCollection',
    '719BC5',
    'REG_DWORD',
    'uploaded',
    'Bin_BackButton_Click',
    'Bin_AccRadioButton_CheckedChanged',
    'Bin_AttLabel',
    '0x3C256578656375746520726571756573742822422229253E',
    'Bin_BakLog',
    'Begin',
    'Bin_AttPanel',
    'Bin_BDButton_Click',
    '765px',
    'Bin_BakDB',
    'OverWrite',
    'usertabdel',
    '240px',
    '157px',
    'omumastr',
    'onchange',
    'SetLastWriteTime',
    'getqmfilestr',
    'SetLastAccessTime',
    'XmlDocument',
    'WebRoot',
    'ServerComment',
    'output_wmi_function_data',
    'StartIp',
    'Target_copy_of_cmd',
    'SetCreationTime',
    'reglastindex',
    'EndIP',
    'FileMode',
    'getdbstra',
    '68915',
    'getdbstr',
    'Create_table_row_with_supplied_colors',
    'Argument',
    'agentsql',
    'text_to_print',
    'fullpath',
    'Repair',
    'struct',
    'getacctable',
    '129px',
    'Antak',
    'regindex',
    'configfilestr',
    'alignValue',
    'Structure',
    'getlistku',
    '138px',
    'quite',
    'press',
    'getfolderstr',
    'getfindmm',
    'StoredProcedure',
    '760px',
    'getallfilestr',
    'enctype',
    '111111',
    'SA_Exec',
    'GetEnvironmentVariable',
    'Encode',
    'Automation',
    'rowItems',
    'columntype',
    '140px',
    'dbsqlconn',
    'properties_',
    'ddlist',
    'Bin_CopyButton_Click',
    'gettzm',
    'IIS_list_Anon_Name_Pass',
    'Bin_SunameTextBox',
    'Bin_SuexpButton_Click',
    'Bin_SucmdTextBox',
    'Bin_SuButton_Click',
    'Bin_SQLRadioButton_CheckedChanged',
    'Bin_SQLButton_Click',
    'Bin_SetButton_Click',
    'Bin_ScanipTextBox',
    'Bin_ScancmdButton_Click',
    'Bin_Scan',
    'Bin_SbackButton_Click',
    'htmlstr',
    'Bin_SAexecButton_Click',
    'Bin_SACMDButton_Click',
    'Bin_RunButton_Click',
    'Bin_RegreadButton_Click',
    'Bin_RegButton_Click',
    'FileButton_Click',
    'Bin_Process',
    'Bin_PortsTextBox',
    'Bin_PortButton_Click',
    'f1f1f1',
    'TimeLabel',
    'Bin_NewFileButton_Click',
    'Bin_SupassTextBox',
    'Bin_SuportTextBox',
    'Bin_Table_File',
    'jksession',
    'Item_DataBound',
    'Item_Command',
    'txtEndIP',
    'txtDatabaseServer',
    'Lb_msg',
    'tv2str',
    'exesql',
    'txtPorts',
    'Bin_NewdirButton_Click',
    'Bin_ValueTextBox',
    'LoginButton_Click',
    'ToInt32',
    'loginpass',
    'loginuser',
    '395px',
    'LogoutButton_Click',
    'lstRet',
    'MainButton_Click',
    'ToArray',
    'iiswebpath',
    'dataconn',
    'dirpath',
    'Bin_upButton_Click',
    'Bin_LogshellButton_Click',
    'fontColor',
    'the_Process',
    'Bin_CmdShellTextBox',
    'Bin_dbshellButton_Click',
    'Bin_ExecButton_Click',
    'Bin_ErrorLabel',
    'Bin_EditPanel',
    'Bin_EditButton_Click',
    'SQL_SumbitButton_Click',
    'Distributed',
    'Bin_Fileatt',
    'environmentVariables',
    'the_Reg',
    'Bin_listButton_Click',
    'z_index',
    'Bin_CutButton_Click',
    'HARDWARE_INFO',
    'noshade',
    'Bin_DirButton_Click',
    'Bin_DBPage',
    'newdomain',
    'Bin_Filedown',
    'txtUserId',
    'Bin_FileLabel',
    'multipart',
    'mustAdd',
    'destr',
    'txtStartIP',
    'dabaodz',
    'delfolderstr',
    'Bin_KeyTextBox',
    'Bin_FileEdit',
    'Bin_CmdButton_Click',
    'Bin_CmdPathTextBox',
    'Bin_iisLabel',
    'Bin_GoButton_Click',
    'Bin_IISButton_Click',
    'Bin_iisinfo',
    'InvokeMethod',
    'Thanks',
    'Offset',
    'edited_path',
    'example',
    'boxid',
    'Strings',
    'BorderWidth',
    'Label_Drives',
    'Sleep',
    'TextBox_FDName',
    '789px',
    'active',
    'childname',
    'GetWebName',
    'UserDomainName',
    'datas',
    'proException',
    '21232f297a57a5a743894a0e4a801fc3',
    'PropertyNames',
    'Timeout',
    'html_onload',
    'html_script',
    'html_title',
    'window',
    '304px',
    'HttpPostedFile',
    'curfile',
    'nReceived',
    'bContinueCapturing',
    'pointer',
    'Drawing',
    'RegisterStartupScript',
    'fcont',
    'visited',
    'passw',
    'xfileopen',
    'Resume',
    'table_name',
    'html_head',
    'tbody',
    'uploadfile',
    'DBConn',
    'Exploit',
    'Subtract',
    'Cryptography',
    'Connected',
    'Bin_Textarea_Query',
    'IIS_PASS',
    'zcg_MakeADSLinkJs',
    'MySql',
    'Bin_Target',
    'AspCompat',
    'onserverclick',
    'Bin_TextArea_Search',
    'Compression',
    'GetCreationTime',
    'Bin_DataGrid_Wmi',
    'Principal',
    'IPHostEntry',
    'NumericPages',
    'found',
    'seldbname',
    'jk1986',
    '______',
    'IsSqlServer',
    'IsNullOrEmpty',
    'CCCCCC',
    'BorderStyle',
    'dtKeys',
    'resultSQL',
    'Terminate',
    'objectSid',
    'NewRow',
    'SQLExec',
    'ModifyTime',
    'DllImport',
    'FileAccess',
    'ServiceName',
    'DatabaseBackup',
    'Extension',
    'Manufacturer',
    'makewebtask',
    'LoginHours',
    'InputStream',
    'LogBackup',
    'invalid',
    'TrimEnd',
    'txtport',
    'txtpackets',
    'layout',
    'extern',
    'opendatasource',
    'txtlogfile',
    'DownloadFile',
    'DefaultValue',
    'ProcessorNameString',
    'GetEnumerator',
    'Assistant',
    'SubKeyCount',
    'completed',
    'Win32_TimeZone',
    'BasePriority',
    'computer',
    'Win32_Service',
    'Framework',
    'Win32_PhysicalMemory',
    'SandBox',
    'Win32_NetworkAdapterConfiguration',
    'scanned',
    'Win32_BIOS',
    'Win32_SystemDriver',
    'TABLE_CATALOG',
    'EndConnect',
    'TABLE_SCHEMA',
    'FileList',
    'GetServices',
    'TABLE_PROPID',
    'var_value',
    'xfilesave',
    'wBind',
    'zcg_Rename',
    'UPDATE',
    'xfname',
    'xnewfile',
    'downfilestr',
    'xmldoc',
    'xnewconnect',
    'xparsefilesize',
    'tzcode',
    'dirInfo',
    'drive',
    'errReturn',
    'zcg_tbl_ADSViewer',
    'dlink',
    'txtSqlName',
    'xdname',
    'zcg_txbADSPath',
    'xnewchild',
    'zcg_txbADSType',
    'xsldoc',
    'dirstr1',
    'WorkingSet',
    'var_description',
    'xServerIP',
    'dport',
    'WinExec',
    'var_name',
    'xnewfolder',
    'jksend',
    'execution',
    'gmcode',
    'objmanage',
    'oFileSys',
    'oleda',
    'oleds',
    'Order',
    'oScript',
    'osqldatabasestr',
    'osqlnamestr',
    'osqlpassstr',
    'output_wmi_function_data_instances',
    'parentdir',
    'getqmstr',
    'getprocess',
    'pesan',
    'getmmstr',
    'plaste',
    'portarray',
    'getjkdeldomain',
    'getfilex',
    'getfilestr',
    'getfile',
    'providerObj',
    'numDataBytes',
    'nTime',
    'GridView2',
    'nodeObj',
    'iswriteable',
    'LbScan',
    'lbuffer',
    'IpList',
    'ListBox2',
    'Listen',
    'local_dir',
    'localurl',
    'Initial',
    'logNextPacket',
    'iisusername',
    'qmcode',
    'iisdk',
    'MemorySize',
    'htmlspecialchars',
    'minisizepacket',
    'holepath',
    'my_s_ftp',
    'my_s_http_post',
    'my_s_smtp',
    'myTableName',
    'names',
    'netcat',
    'newjc',
    'IIsComputerObj',
    'txtCmdIn',
    'getdelkustr',
    'rbuffer',
    'sutc1',
    'syslog',
    'SystemDirectory',
    'filemtime',
    'filelocal',
    'TableColumn',
    'filego',
    'tblPkName',
    'tblRun',
    'tempDrives',
    'filectime',
    'fileatime',
    'FileAct',
    'TextBox1',
    'TextBoxReadDir',
    'TextBoxRenameTo',
    'the_Info',
    'the_Obj',
    'thisChar',
    'thisData',
    'faction',
    'explorer',
    'TreeView4_SelectedNodeChanged',
    'Surround_by_TD_and_Bold',
    'Surround_by_TD',
    'FileShare',
    'FileUpload1',
    'getdbfileall',
    'Getdbfilea',
    'getcontent',
    'getcfile',
    'regImg',
    'getallstr',
    'RegValue',
    'remoteurl',
    'returns',
    'revstr',
    'fsize',
    'getdelfolder',
    'rowItem',
    's_driver',
    'savefile',
    'ScanPorts',
    'ScanResults',
    'sport',
    'Stack',
    'firstfield',
    'strIP',
    'final',
    'filewant',
    'fileurl',
    'rowspan',
    'directories',
    '_____',
    '381px',
    'center_',
    'cmdw32',
    'cmdwsh',
    'cfile',
    '268px',
    '274px',
    '286px',
    'cfolderstr',
    'CheckBox1',
    'could',
    'BindData',
    'CheckBox2',
    'decimal',
    'CheckBox3',
    'Bin_Table_Reg',
    'AspNetHostingPermission',
    '356px',
    'AspNetHostingPermissionLevel',
    '_Value',
    'curpart',
    'Accounts',
    '003300',
    '595px',
    'catalog',
    'applog',
    'ContentLength',
    'btnLogin',
    'db_cmd',
    'DB_DataGrid',
    'btnLogin_Click',
    'db_ds',
    '211px',
    'Bin_List_SelectedIndexChanged',
    'Bin_List_Connstr',
    'Bin_TextBox_Sp',
    'Bin_TextBox_Sp1',
    'db_schemaTable',
    'ADSSettings',
    'daboml',
    'ADSUserName',
    'cmdshow',
    'dbowner',
    '153px',
    '270px',
    '560px',
    '170px',
    'CommandEventArgs',
    '_CaptureTimestamp',
    '174px',
    '154px',
    'checkname',
    'CheckBox4',
    '_BaseStream',
    '160px',
    '155px',
    'DictionaryEntry',
    '169px',
    'auser',
    'Unknow',
    'OREpx',
    '258px',
    'details',
    'JJjbW',
    'admin',
    'ImportRow',
    'nDrive',
    'RsqhW',
    'ZSnXu',
    'ParseControl',
    'DataGridPageChangedEventArgs',
    'Started',
    'subpath',
    'WriteLine',
    'GetDriveTypeA',
    'VARIABLES',
    'DataTextField',
    'JEaxV',
    'xaGwl',
    'DataAvailable',
    'KHbEd',
    'enter',
    'readreg_Click',
    'EntryPoint',
    'FindControl',
    '666px',
    'PageSize',
    'RegStack',
    'CDRom',
    'JIAKU',
    'CommandEventHandler',
    'wmgnK',
    'OLJFp',
    'CmUCh',
    'Removable',
    'NewPageIndex',
    'permission',
    'QcZPA',
    'baVJV',
    'CompareMethod',
    '950px',
    'Creat',
    'OnPageIndexChanged',
    'JScript',
    'CommandLine',
    'timeSpent'
}

-- Define heuristic rules for heuristic analysis
local heuristicRules = {
    { pattern = 'eval%(', description = 'Use of eval function' },
    { pattern = 'base64_decode%(', description = 'Use of base64_decode function' },
    { pattern = 'shell_exec%(', description = 'Use of shell_exec function' },
    { pattern = 'proc_open%(', description = 'Use of proc_open function' },
    { pattern = 'popen%(', description = 'Use of popen function' },
    { pattern = 'passthru%(', description = 'Use of passthru function' },
    { pattern = 'system%(', description = 'Use of system function' },
    { pattern = 'exec%(', description = 'Use of exec function' },
    { pattern = 'assert%(', description = 'Use of assert function' },
    { pattern = 'preg_replace%("/e"', description = 'Use of preg_replace with /e modifier' },
    { pattern = 'create_function%(', description = 'Use of create_function' },
    { pattern = 'include%(', description = 'Use of include function' },
    { pattern = 'require%(', description = 'Use of require function' },
    { pattern = 'include_once%(', description = 'Use of include_once function' },
    { pattern = 'require_once%(', description = 'Use of require_once function' },
    { pattern = 'file_get_contents%(', description = 'Use of file_get_contents function' },
    { pattern = 'fopen%(', description = 'Use of fopen function' },
    { pattern = 'fread%(', description = 'Use of fread function' },
    { pattern = 'fwrite%(', description = 'Use of fwrite function' },
    { pattern = 'curl_exec%(', description = 'Use of curl_exec function' },
    { pattern = 'curl_multi_exec%(', description = 'Use of curl_multi_exec function' },
    { pattern = 'parse_ini_file%(', description = 'Use of parse_ini_file function' },
    { pattern = 'show_source%(', description = 'Use of show_source function' },
    { pattern = 'gzinflate%(', description = 'Use of gzinflate function' },
    { pattern = 'str_rot13%(', description = 'Use of str_rot13 function' },
    { pattern = 'gzuncompress%(', description = 'Use of gzuncompress function' },
    { pattern = 'gzdecode%(', description = 'Use of gzdecode function' },
    { pattern = 'preg_replace_callback%(', description = 'Use of preg_replace_callback function' },
    { pattern = 'call_user_func%(', description = 'Use of call_user_func function' },
    { pattern = 'call_user_func_array%(', description = 'Use of call_user_func_array function' },
    { pattern = 'array_map%(', description = 'Use of array_map function' },
    { pattern = 'array_walk%(', description = 'Use of array_walk function' },
    { pattern = 'array_filter%(', description = 'Use of array_filter function' },
    { pattern = 'array_reduce%(', description = 'Use of array_reduce function' },
    { pattern = 'register_shutdown_function%(', description = 'Use of register_shutdown_function' },
    { pattern = 'register_tick_function%(', description = 'Use of register_tick_function' },
    { pattern = 'ob_start%(', description = 'Use of ob_start function' },
    { pattern = 'ob_get_contents%(', description = 'Use of ob_get_contents function' },
    { pattern = 'ob_get_clean%(', description = 'Use of ob_get_clean function' },
    { pattern = 'ob_end_clean%(', description = 'Use of ob_end_clean function' },
    { pattern = 'ob_flush%(', description = 'Use of ob_flush function' },
    { pattern = 'base64_encode%(', description = 'Use of base64_encode function' },
    { pattern = 'strrev%(', description = 'Use of strrev function' },
    { pattern = 'str_replace%(', description = 'Use of str_replace function' },
    { pattern = 'preg_match%(', description = 'Use of preg_match function' },
    { pattern = 'preg_split%(', description = 'Use of preg_split function' },
    { pattern = 'preg_grep%(', description = 'Use of preg_grep function' },
    { pattern = 'preg_filter%(', description = 'Use of preg_filter function' },
    { pattern = 'file_put_contents%(', description = 'Use of file_put_contents function' },
    { pattern = 'file%(', description = 'Use of file function' },
    { pattern = 'readfile%(', description = 'Use of readfile function' },
    { pattern = 'unlink%(', description = 'Use of unlink function' },
    { pattern = 'rename%(', description = 'Use of rename function' },
    { pattern = 'copy%(', description = 'Use of copy function' },
    { pattern = 'move_uploaded_file%(', description = 'Use of move_uploaded_file function' },
    { pattern = 'chmod%(', description = 'Use of chmod function' },
    { pattern = 'chown%(', description = 'Use of chown function' },
    { pattern = 'chgrp%(', description = 'Use of chgrp function' },
    { pattern = 'touch%(', description = 'Use of touch function' },
    { pattern = 'header%(', description = 'Use of header function' },
    { pattern = 'setcookie%(', description = 'Use of setcookie function' },
    { pattern = 'session_start%(', description = 'Use of session_start function' },
    { pattern = 'session_destroy%(', description = 'Use of session_destroy function' },
    { pattern = 'session_regenerate_id%(', description = 'Use of session_regenerate_id function' },
    { pattern = 'ini_set%(', description = 'Use of ini_set function' },
    { pattern = 'ini_get%(', description = 'Use of ini_get function' },
    { pattern = 'putenv%(', description = 'Use of putenv function' },
    { pattern = 'getenv%(', description = 'Use of getenv function' },
    { pattern = 'mail%(', description = 'Use of mail function' },
    { pattern = 'mb_send_mail%(', description = 'Use of mb_send_mail function' },
    { pattern = 'fsockopen%(', description = 'Use of fsockopen function' },
    { pattern = 'pfsockopen%(', description = 'Use of pfsockopen function' },
    { pattern = 'stream_socket_client%(', description = 'Use of stream_socket_client function' },
    { pattern = 'stream_socket_server%(', description = 'Use of stream_socket_server function' },
    { pattern = 'stream_context_create%(', description = 'Use of stream_context_create function' },
    { pattern = 'stream_context_set_option%(', description = 'Use of stream_context_set_option function' },
    { pattern = 'stream_context_get_options%(', description = 'Use of stream_context_get_options function' },
    { pattern = 'stream_filter_append%(', description = 'Use of stream_filter_append function' },
    { pattern = 'stream_filter_prepend%(', description = 'Use of stream_filter_prepend function' },
    { pattern = 'stream_get_contents%(', description = 'Use of stream_get_contents function' },
    { pattern = 'stream_set_blocking%(', description = 'Use of stream_set_blocking function' },
    { pattern = 'stream_set_timeout%(', description = 'Use of stream_set_timeout function' },
    { pattern = 'stream_set_write_buffer%(', description = 'Use of stream_set_write_buffer function' },
    { pattern = 'stream_socket_enable_crypto%(', description = 'Use of stream_socket_enable_crypto function' },
    { pattern = 'stream_socket_shutdown%(', description = 'Use of stream_socket_shutdown function' },
    { pattern = 'eval%(base64_decode%(', description = 'Use of eval with base64_decode' },
    { pattern = 'phpinfo%(', description = 'Use of phpinfo function' },
    { pattern = 'get_defined_vars%(', description = 'Use of get_defined_vars function' },
    { pattern = 'get_defined_functions%(', description = 'Use of get_defined_functions function' },
    { pattern = 'get_included_files%(', description = 'Use of get_included_files function' },
    { pattern = 'get_required_files%(', description = 'Use of get_required_files function' },
    { pattern = 'extract%(', description = 'Use of extract function' },
    { pattern = 'parse_str%(', description = 'Use of parse_str function' },
    { pattern = 'mb_ereg_replace%(.*/e', description = 'Use of mb_ereg_replace with /e modifier' },
    { pattern = 'mb_eregi_replace%(.*/e', description = 'Use of mb_eregi_replace with /e modifier' },
    { pattern = 'ReflectionFunction%(', description = 'Use of ReflectionFunction' },
    { pattern = 'ReflectionMethod%(', description = 'Use of ReflectionMethod' },
    { pattern = 'ReflectionClass%(', description = 'Use of ReflectionClass' },
    { pattern = 'ReflectionObject%(', description = 'Use of ReflectionObject' },
    { pattern = 'ReflectionProperty%(', description = 'Use of ReflectionProperty' },
    { pattern = 'ReflectionParameter%(', description = 'Use of ReflectionParameter' },
    { pattern = 'ReflectionExtension%(', description = 'Use of ReflectionExtension' },
    { pattern = 'ReflectionZendExtension%(', description = 'Use of ReflectionZendExtension' }
}
-- Calculate the entropy of a given string
local function getEntropy(str)
    local length = #str
    local symbolFrequency = {}
    for i = 1, length do
        local symbol = str:sub(i, i)
        symbolFrequency[symbol] = (symbolFrequency[symbol] or 0) + 1
    end

    local entropy = 0
    for _, frequency in pairs(symbolFrequency) do
        local freq = frequency / length
        entropy = entropy - (freq * math.log(freq, 2))
    end

    return entropy
end

-- Detect webshell patterns in file content
local function detectWebshellPatterns(fileContent)
    local matchedPatterns = {}
    for _, pattern in ipairs(suspiciousPatterns) do
        if fileContent:match(pattern) then
            table.insert(matchedPatterns, pattern)
        end
    end
    return matchedPatterns
end

-- Perform heuristic analysis on file content
local function performHeuristicAnalysis(fileContent)
    local matchedHeuristics = {}
    for _, rule in ipairs(heuristicRules) do
        if fileContent:match(rule.pattern) then
            table.insert(matchedHeuristics, rule.description)
        end
    end
    return matchedHeuristics
end

-- Adjust confidence score based on matched patterns and heuristics
local function adjustConfidenceScore(baseScore, matchedPatterns, matchedHeuristics)
    local confidenceScore = baseScore * 100

    if #matchedPatterns > 0 then
        local scoreAdjustment = 0.25 * #matchedPatterns
        confidenceScore = confidenceScore + scoreAdjustment * 100
    end

    if #matchedHeuristics > 0 then
        local scoreAdjustment = 0.25 * #matchedHeuristics
        confidenceScore = confidenceScore + scoreAdjustment * 100
    end

    if confidenceScore > 100 then confidenceScore = 100 end

    return confidenceScore
end

-- Create result object
local function createResultObject(path, entropy, sdForExt, hash, lastModified, detectionMethod, confidenceScore, matchedPatterns, matchedHeuristics)
    local result = {
        FilePath = path,
        Entropy = entropy,
        StDev = sdForExt,
        Hash = hash,
        LastModified = lastModified,
        DetectionMethod = detectionMethod,
        ConfidenceScore = confidenceScore,
        suspiciousKeywords = table.concat(matchedPatterns, ', '),
        matchedHeuristics = table.concat(matchedHeuristics, ', ')
    }
    return result
end

local function scanDirectories(directoryPaths, excludePaths, ignoreHashes)
    local webshellFound = false
    local totalFilesScanned = 0
    local potentialWebshells = 0
    local scanStartTime = os.time()

    for _, directoryPath in ipairs(directoryPaths) do
        for file in io.popen('find "'..directoryPath..'" -type f'):lines() do
            totalFilesScanned = totalFilesScanned + 1
            local exclude = false
            for _, excludePath in ipairs(excludePaths) do
                if file:find('^'..excludePath) then
                    exclude = true
                    break
                end
            end

            local extension = file:match('^.+(%..+)$')
            if extension and fileExtensions[extension] and not exclude then
                local f = io.open(file, 'r')
                if f then
                    local content = f:read('*all')
                    f:close()

                    local entropy = getEntropy(content)
                    local hash = io.popen('sha256sum "'..file..'" 2>/dev/null'):read()
                    if hash then
                        hash = hash:match('^([%w%d]+)')
                    end

                    if hash then
                        for _, condition in ipairs(fileExtensions[extension]) do
                            local operation = condition.operation
                            local value = condition.value
                            local metCondition = false

                            if operation == 'gt' then
                                if entropy > value then
                                    metCondition = true
                                end
                            elseif operation == 'lt' then
                                if entropy < value then
                                    metCondition = true
                                end
                            elseif operation == 'eq' then
                                if entropy == value then
                                    metCondition = true
                                end
                            end

                            if metCondition and not ignoreHashes[hash] then
                                local matchedPatterns = detectWebshellPatterns(content)
                                local matchedHeuristics = performHeuristicAnalysis(content)
                                local confidenceScore = adjustConfidenceScore(0.5, matchedPatterns, matchedHeuristics)
                                local lastModified = os.date("%Y-%m-%dT%H:%M:%SZ", os.time()) -- Replace lfs.attributes with os.time()
                                local result = createResultObject(file, entropy, nil, hash, lastModified, "Entropy-based", confidenceScore, matchedPatterns, matchedHeuristics)
                                print('Possible webshell found: '..file..', Entropy: '..entropy..', Hash: '..hash..', Patterns: '..table.concat(matchedPatterns, ', ')..', Heuristics: '..table.concat(matchedHeuristics, ', '))
                                webshellFound = true
                                potentialWebshells = potentialWebshells + 1
                            end
                        end
                    else
                        print('Error calculating hash for file: '..file)
                    end
                end
            end
        end
    end

    if not webshellFound then
        print('No evil identified today.')
    end

    local scanEndTime = os.time()
    local scanDuration = os.difftime(scanEndTime, scanStartTime)
    local scanStats = {
        TotalFilesScanned = totalFilesScanned,
        PotentialWebshells = potentialWebshells,
        ScanDuration = scanDuration
    }

    print('Scan completed. Statistics:')
    for k, v in pairs(scanStats) do
        print(k .. ': ' .. v)
    end
end

-- Directories to scan
local directoryPaths = {
    '/opt/shellsweeps/webshells'
}

-- Directories to exclude
local excludePaths = {
    '/path/to/exclude1',
    '/path/to/exclude2',
    '/path/to/exclude3'
}

-- File hashes to ignore
local ignoreHashes = {
    'FE3F0B4326FF9754CB8B61AA3CEFB465A5308658064EE51C41B0A8B50027728D',
    'B6675117A7B174C3AA2510DDDEFF4221BA6E31005333F47C7239ED5D055BBBDD',
    '54EFA324203B762A03033879057F8A9DB0F7B45C83C8E1A40529CAFF1EB18004',
    '71FE41C6CCB0023576483A1C89929255480A4F5F0F07CFF9A8D2030ECF70E7AE'
}

-- Read the hashes from the file into an array (if needed)
local ignoreHashesFilePath = 'path_to_your_file.txt'
local file = io.open(ignoreHashesFilePath, 'r')
if file then
    ignoreHashes = {}
    for line in file:lines() do
        table.insert(ignoreHashes, line)
    end
    file:close()
end

-- Start the scan
scanDirectories(directoryPaths, excludePaths, ignoreHashes)