add detect webshell~

Signed-off-by: youstar <opcodesec@gmail.com>