#Get-WinEvent | where {(($_.message -match "Signature.*PHP/" -or $_.message -match "Signature.*JSP/" -or $_.message -match "Signature.*ASP/" -or $_.message -match "Signature.*Perl/" -or $_.message -match "Signature.*PHP." -or $_.message -match "Signature.*JSP." -or $_.message -match "Signature.*ASP." -or $_.message -match "Signature.*Perl." -or $_.message -match "Signature.*VBS/Uxor" -or $_.message -match "Signature.*IIS/BackDoor" -or $_.message -match "Signature.*JAVA/Backdoor" -or $_.message -match "Signature.*Troj/ASP" -or $_.message -match "Signature.*Troj/PHP" -or $_.message -match "Signature.*Troj/JSP") -or ($_.message -match "Signature.*.*Webshell" -or $_.message -match "Signature.*.*Chopper" -or $_.message -match "Signature.*.*SinoChoper" -or $_.message -match "Signature.*.*ASPXSpy" -or $_.message -match "Signature.*.*Aspdoor" -or $_.message -match "Signature.*.*filebrowser" -or $_.message -match "Signature.*.*PHP_" -or $_.message -match "Signature.*.*JSP_" -or $_.message -match "Signature.*.*ASP_" -or $_.message -match "Signature.*.*PHP:" -or $_.message -match "Signature.*.*JSP:" -or $_.message -match "Signature.*.*ASP:" -or $_.message -match "Signature.*.*Perl:" -or $_.message -match "Signature.*.*PHPShell" -or $_.message -match "Signature.*.*Trojan.PHP" -or $_.message -match "Signature.*.*Trojan.ASP" -or $_.message -match "Signature.*.*Trojan.JSP" -or $_.message -match "Signature.*.*Trojan.VBS" -or $_.message -match "Signature.*.*PHP?Agent" -or $_.message -match "Signature.*.*ASP?Agent" -or $_.message -match "Signature.*.*JSP?Agent" -or $_.message -match "Signature.*.*VBS?Agent" -or $_.message -match "Signature.*.*Backdoor?PHP" -or $_.message -match "Signature.*.*Backdoor?JSP" -or $_.message -match "Signature.*.*Backdoor?ASP" -or $_.message -match "Signature.*.*Backdoor?VBS" -or $_.message -match "Signature.*.*Backdoor?Java")) } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message

function Add-Rule {

    $ruleName = "av_webshell";
    $detectRule = {
        
        function Search-DetectableEvents {
            param (
                $event
            )
            
            $ruleName = "av_webshell";
            $detectedMessage = " Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big webshell repo from e.g. github and checking the matches.";
            $result = $event | where { (($_.message -match "Signature.*PHP/" -or $_.message -match "Signature.*JSP/" -or $_.message -match "Signature.*ASP/" -or $_.message -match "Signature.*Perl/" -or $_.message -match "Signature.*PHP." -or $_.message -match "Signature.*JSP." -or $_.message -match "Signature.*ASP." -or $_.message -match "Signature.*Perl." -or $_.message -match "Signature.*VBS/Uxor" -or $_.message -match "Signature.*IIS/BackDoor" -or $_.message -match "Signature.*JAVA/Backdoor" -or $_.message -match "Signature.*Troj/ASP" -or $_.message -match "Signature.*Troj/PHP" -or $_.message -match "Signature.*Troj/JSP") -or ($_.message -match "Signature.*.*Webshell" -or $_.message -match "Signature.*.*Chopper" -or $_.message -match "Signature.*.*SinoChoper" -or $_.message -match "Signature.*.*ASPXSpy" -or $_.message -match "Signature.*.*Aspdoor" -or $_.message -match "Signature.*.*filebrowser" -or $_.message -match "Signature.*.*PHP_" -or $_.message -match "Signature.*.*JSP_" -or $_.message -match "Signature.*.*ASP_" -or $_.message -match "Signature.*.*PHP:" -or $_.message -match "Signature.*.*JSP:" -or $_.message -match "Signature.*.*ASP:" -or $_.message -match "Signature.*.*Perl:" -or $_.message -match "Signature.*.*PHPShell" -or $_.message -match "Signature.*.*Trojan.PHP" -or $_.message -match "Signature.*.*Trojan.ASP" -or $_.message -match "Signature.*.*Trojan.JSP" -or $_.message -match "Signature.*.*Trojan.VBS" -or $_.message -match "Signature.*.*PHP?Agent" -or $_.message -match "Signature.*.*ASP?Agent" -or $_.message -match "Signature.*.*JSP?Agent" -or $_.message -match "Signature.*.*VBS?Agent" -or $_.message -match "Signature.*.*Backdoor?PHP" -or $_.message -match "Signature.*.*Backdoor?JSP" -or $_.message -match "Signature.*.*Backdoor?ASP" -or $_.message -match "Signature.*.*Backdoor?VBS" -or $_.message -match "Signature.*.*Backdoor?Java")) } | select TimeCreated, Id, RecordId, ProcessId, MachineName, Message;
            if ($result -and $result.Count -ne 0) {
                Write-Output ""; 
                Write-Output "Detected! RuleName:$ruleName";
                Write-Output $detectedMessage;
                Write-Output $result;
                Write-Output ""; 
            }
        };
        . Search-DetectableEvents $args;
    };
    if(! $ruleStack[$ruleName]) {
        $ruleStack.Add($ruleName, $detectRule);
    } else {
       Write-Host "Rule Import Error"  -Foreground Yellow;
    }
}