MalwareCodeScanner.ps1

<#
    Author: Johto Robbie
    License: GPLv3
#>

param (
    [Parameter(Mandatory = $true)]
    [string]$projectFolderPath
)

# Trim the project folder path to remove leading/trailing spaces
$projectFolderPath = $projectFolderPath.Trim()

# Extract the project folder name for output file
$folderName = [System.IO.Path]::GetFileName($projectFolderPath.TrimEnd('\'))
$outputFilePath = "$folderName-scan-results.txt"
$jsonOutputPath = "$folderName-scan-results.json"
$csvOutputPath = "$folderName-scan-results.csv"

# Initialize matches array
$allMatches = @()

# Define detection patterns and rules
$patterns = @(
    @{
        Type = "Shellcode Patterns" 
        Patterns = @(
            "\b(?:[0-9a-fA-F]{2}[\s,]+){8,}\b", # Basic hex sequences - detect raw shellcode bytes
            "\\x[0-9a-fA-F]{2}(?:\\x[0-9a-fA-F]{2}){7,}", # \x format shellcode - common in exploits
            "(?:%u[0-9a-fA-F]{4}){4,}", # Unicode shellcode patterns - often used to bypass filters
            "\b(?:0x[0-9a-fA-F]{8,})\b", # Memory addresses and long hex values
            "\b(?:mov|push|pop|call|jmp|ret)\s+(?:eax|ebx|ecx|edx|esi|edi)\b" # Common assembly instruction patterns found in shellcode
        )
        Whitelist = @(
            # .NET runtime and interop patterns
            'System\.Runtime\.InteropServices',
            'DllImport\(.+?\)',
            'Marshal\.(Copy|Alloc)',
        
            # Legitimate PowerShell API calls
            'Add-Type',
            'VirtualAlloc',
            'CreateThread', 
            'WaitForSingleObject',
        
            # Common programming language constructs
            '(?:public|private|protected)\s+(?:class|struct|enum)',
            '(?:function|def|sub)\s+\w+\s*\(',
        
            # Hash values and crypto patterns
            '[A-Fa-f0-9]{32,}',                # MD5/SHA hashes
            '0x[0-9A-Fa-f]+(?:\s*,\s*0x[0-9A-Fa-f]+){0,3}', # Small hex arrays
        
            # CSS color codes and styling
            '#[0-9A-Fa-f]{6}\b',
            'rgba?\([^)]+\)',
        
            # Memory allocation and pointer operations
            '(?:malloc|free|new|delete)\s*\([^)]*\)',
            '(?:memcpy|memset|memmove)\s*\([^)]*\)'
        )
    },
    @{
        Type = "Injection Functions"
        Patterns = @(
            # PowerShell Commands
            "Invoke-Expression",
            "iex",
            "Invoke-Command",
            "icm", 
            "Start-Process",
            "Invoke-Item",
            "New-Object",
            "Add-Type",
        
            # Windows API
            "CreateRemoteThread",
            "OpenProcess", 
            "VirtualAllocEx",
            "WriteProcessMemory",
            "ReadProcessMemory",
            "GetProcAddress",
            "LoadLibraryA",
            "LoadLibraryW",
            "VirtualFreeEx",
            "CreateProcessA",
            "CreateProcessW",
            "VirtualProtect",
            "HeapCreate",
            "HeapAlloc",
        
            # Reflection
            "System\.Reflection",
            "Assembly\.Load",
            "[RuntimeType]",
        
            # Script Execution
            "\$ExecutionContext",
            "ScriptBlock",
            "ExpandString",
            "-EncodedCommand",
            "-ExecutionPolicy",
            "-NoProfile"
        )
    
        Whitelist = @(
            # Development Paths
            "vendor/",
            "node_modules/",
            "packages/",
            "bin/",
            "obj/",
            "dist/",
            "build/",
            "test/",
        
            # Code Comments
            "//.*",
            "#.*",
            "/\*[\s\S]*?\*/",
            "'''[\s\S]*?'''", 
            '"""[\s\S]*?"""',
        
            # Documentation
            "@param",
            "@return",
            "TODO:",
            "FIXME:",
        
            # Function References
            'function\s+reference',
        
            # Generated Code
            'composer',
            'autoload',
            'vendor',
            'generated'
        )
    },
    @{ 
        Type = "Webshell Functions"
        Patterns = @(
            # PowerShell Command Execution
            "\bInvoke-Expression\s*\(|\bIEX\s*\(",
            "\bInvoke-Command\s*\(",
            "\bStart-Process\s*\(",
            "\bInvoke-WmiMethod\s*\(",
            "\bInvoke-RestMethod\s*\(",
            "\bInvoke-WebRequest\s*\(",

            # Code Execution & Reflection
            "\bAdd-Type\s*\(",
            "\b[System\.Reflection\.Assembly]::(Load|LoadFrom|LoadFile)",
            "\bCreateInstance\s*\(",
            "\bScriptBlock\.Create\s*\(",
            "\bGet-WmiObject\s*\(",
            "\bGet-CimInstance\s*\(",

            # Network Operations
            "\bNew-Object\s+(Net\.WebClient|System\.Net\.Sockets\.(TCP|UDP)Client)",
            "\bDownload(String|File)\s*\(",
            "\bTest-(Net)?Connection\s*\(",
            "\bWNet\.",
            "\bNet\s+(User|LocalGroup)\s*\(",

            # File Operations
            "\b(Set|Add)-Content\s*\(",
            "\bOut-File\s*\(",
            "\bNew-Item\s*\(",
            "\b(Copy|Move|Remove)-Item\s*\(",
            "\b(Compress|Expand)-Archive\s*\(",

            # Registry & Service Operations
            "\b(Get|Set|New)-ItemProperty\s*\(",
            "\b(New|Start)-Service\s*\(",

            # Encoding/Decoding
            "\b[Convert]::(From|To)Base64String\s*\(",
            "\b[System\.Text\.Encoding]::(UTF8|ASCII|Unicode)\.GetString\s*\(",
            "\bSystem\.Convert\.",

            # Remote Management
            "\bEnable-PSRemoting\s*\(",
            "\b(New|Connect)-PSSession\s*\(",
            "\bSet-PSSessionConfiguration\s*\(",

            # Process & Job Management
            "\bStart-Job\s*\(",
            "\bRegister-(ScheduledJob|WmiEvent)\s*\(",
            "\bInvoke-AsWorkflow\s*\(",

            # Additional Potential Risks
            "\bReflection\.Emit\.",
            "\bRunspace\.",
            "\bPowerShell\.(Create|AddScript)\s*\(",
            "\bWMISecurity\.",
            "\bGet-Process\s*\(",
            "\bStop-Process\s*\(",
            "\bEnvironment\.\w+\.",
            "\bSystem\.Diagnostics\.",
            "\bSystem\.IO\."
        )
        Whitelist = @(
            # Comments & Documentation
            '^\s*#.*$', 
            '^\s*<#[\s\S]*?#>',

            # Safe Paths & Files
            '\\(Tests|UnitTests|Examples|Samples)\\', 
            '\.(config|psd1|psm1|tests\.ps1)$', 
            '(Program\s+Files|Windows\\System32|WindowsPowerShell)',

            # Development Context
            '(test|mock|unittest|example|debug|log)', 
            '(visual\s+studio|vscode|rider|jetbrains|resharper)', 

            # Safe Functions & Modules
            'function\s+(Get|Test|ConvertTo|ConvertFrom)-', 
            'Microsoft\.PowerShell\.', 
            'System\.Management\.Automation\.', 
            '(Import|Export)-Module', 
            'Using\s+module',

            # Logging & Output
            'Write-(Host|Output|Verbose|Debug)',

            # Parameters & Error Handling
            '-(ErrorAction|WarningAction|InformationAction|Verbose|Debug)', 

            # Testing Frameworks
            '(Pester|Should|Context|Describe|Mock)', 

            # Build & Configuration
            '(build|deploy|install)\.ps1$', 
            '(config|build|generate|nuget|package)', 

            # Module Structure
            'module', 
            'function\s+\w+', 
            'class\s+\w+', 
            'interface\s+\w+', 

            # Common Safe Operations
            'PSModulePath', 
            'powershell\s+core', 
            'Export-ModuleMember',

            # Additional Safe Context Indicators
            'license', 
            'readme', 
            'documentation', 
            'compliance', 
            'automation', 
            'monitoring', 
            'reporting'
        )
    },
    @{
        Type = "Hardcoded Secrets"
        Patterns = @(
            # Credentials
            '(?i)(password|passwd|pwd)\s*[:=]\s*["`''][^"`'']+["`'']',
            '(?i)(username|user|uid)\s*[:=]\s*["`''][^"`'']+["`'']',
            '(?i)(api[_-]?key|access[_-]?key|secret[_-]?key)\s*[:=]\s*["`''][^"`'']+["`'']',
        
            # Tokens & Auth
            '(?i)(token|jwt|bearer)\s*[:=]\s*["`''][^"`'']+["`'']',
            '(?i)(auth|oauth)\s*[:=]\s*["`''][^"`'']+["`'']',
        
            # Connection Strings
            '(?i)(connection[_-]?string|conn[_-]?str)\s*[:=]\s*["`''][^"`'']+["`'']',
            '(?i)(jdbc:|mongodb://|redis://|mysql://)[^"`'']+["`'']',
        
            # Private Keys
            '(?i)BEGIN\s+(RSA|DSA|EC|OPENSSH)\s+PRIVATE\s+KEY',
            '(?i)(private[_-]?key|secret[_-]?key)\s*[:=]\s*["`''][^"`'']+["`'']',
        
            # Backdoors
            '(?i)(admin|root|administrator|superuser)\s*[:=]\s*["`''][^"`'']+["`'']',
            '(?i)uid\s*[=:]\s*["`'']?0["`'']?',
            '(?i)(shell_exec|system|passthru|exec|eval)\s*\(',
            '(?i)(cmd|command|powershell|bash|sh)\.exe',
            '(?i)Runtime\.getRuntime\(\)\.exec\('
        )
    
        Whitelist = @(
            # Java
            '@Value\(["`''].*["`'']\)',
            '@PropertySource',
            'application\.properties',
            'application\.yml',
        
            # .NET
            'appsettings\.json',
            'web\.config',
            'IConfiguration',
            'IOptions<',
            'UserSecrets',
        
            # Python
            'os\.environ\.get',
            'config\.get',
            'settings\.py',
        
            # Node.js
            'process\.env',
            '\.env',
            'config\.js',
        
            # Go
            'os\.Getenv',
            'viper\.Get',
        
            # Test Files
            '[._](test|spec|mock)',
            '(test|spec)/.*\.',
        
            # Example Files
            '\.(example|sample|template)',
            'examples?/',
        
            # Documentation
            '(readme|docs?|documentation)',
            '[._]md$',
        
            # Secret Management
            'vault\.',
            'secrets[_-]manager',
            'key[_-]vault',
            'encrypted[_-]'
        )
    },
    @{
        Type = "Webshell via File Upload"
        Patterns = @(
        # Common file upload methods and libraries across multiple languages (C#, PHP, Java, etc.)
        # Detects patterns for methods involved in file uploading

        # C#/.NET specific file upload methods
        'HttpPostedFile(Base)?',            # C# HttpPostedFile (common in ASP.NET MVC)
        'File\.SaveAs\(',                   # C# specific method for saving files to disk
        'System\.Web\.HttpPostedFileBase',  # HttpPostedFileBase (ASP.NET MVC)
        
        # PHP specific file upload functions
        'move_uploaded_file\(',             # PHP file upload move
        'file_put_contents\(',              # PHP function to write files
        '$_FILES',                          # PHP global variable used in file upload handling
        
        # General file upload patterns
        'enctype=["'']multipart/form-data["'']',   # HTML form attribute for file uploads
        '\.UploadFile\(',                   # Common method to handle file uploads
        'upload\(',                         # Generic upload method detection
        
        # Common patterns for handling file uploads
        '(?i)(upload|process)(File|Upload)',    # Variants for method names that handle file upload
        '(?i)handle(File|FileUpload)',        # Generic file handling functions in upload contexts
        
        # Detects potentially insecure ways of handling file uploads
        'move_uploaded_file\(',             # PHP file move upload, commonly insecure
        'file_put_contents\(',              # Insecure file writes (PHP, other languages)

        # Broader patterns that may indicate insecure file handling
        '(?i)(upload|process)(File|Upload|Handler)',  # Broad terms for insecure upload methods
        'file\s*(?:\+|=)\s*new\s*File\(',    # Detects file creation and manipulation
        '(?i)unsafeFileUpload',             # Detects a possible insecure file upload flag
        '(?i)allow\W*File\W*Upload',        # Detects potentially insecure file upload flags in code
        'Request\.Files',                   # Detects file handling in web frameworks
        'file\s*=\s*new\s*File\('           # Detects file object creation related to uploads
    )

    # Whitelist patterns to avoid false positives
    Whitelist = @(
        # Secure checks for file uploads
        'ValidateFile(Type|Extension|Size)',          # Secure validation for file type, extension, and size
        'Check(File)?(Mime)?Type',                   # Checking mime types for validation
        'Sanitize(FileName)?',                        # Sanitizing file names for security
        'Scan(ForMalware)?',                         # Scanning files for malware before upload
        
        # Secure storage and handling of files
        'SecureFile(Storage|Provider)',               # Storing files securely
        'Safe(File)?Upload',                         # Safe file upload methods

        # Test and testing-related patterns
        '(?:Unit|Integration)Test(Case)?',           # Unit or integration test cases (to avoid test patterns)
        'FileUpload(Test)?',                         # Specific tests for file upload
        
        # Known secure frameworks/libraries
        'Microsoft\.AspNetCore\.Http',               # ASP.NET Core HttpFile handling
        'System\.Web\.HttpPostedFile',               # ASP.NET legacy file upload handling
        'Apache(Commons)?FileUpload',                # Apache Commons FileUpload (secure)
        
        'secureFileUploadMethod',                    # Explicit secure upload methods (whitelist)
        'FileUploadWithSanitization',                 # Uploads with added sanitization and checks
        'SecureFileWrite'                            # Files being written securely
    )
    }
)

function Get-FileHash {
    param (
        [string]$filePath
    )
    
    try {
        $hash = Get-FileHash -Path $filePath -Algorithm SHA256
        return $hash.Hash
    }
    catch {
        return "Could not calculate hash"
    }
}

function Get-FileMetadata {
    param (
        [string]$filePath
    )
    
    try {
        $file = Get-Item $filePath
        return @{
            CreationTime = $file.CreationTime
            LastWriteTime = $file.LastWriteTime
            LastAccessTime = $file.LastAccessTime
            Size = $file.Length
            Extension = $file.Extension
            Hash = Get-FileHash -filePath $filePath
        }
    }
    catch {
        return $null
    }
}

function Test-ValidContext {
    param (
        [string]$content,
        [string]$match,
        [array]$whitelistPatterns
    )
    
    # Get surrounding context (expanded to 100 characters before and after)
    $contextStart = [Math]::Max(0, $content.IndexOf($match) - 100)
    $contextLength = [Math]::Min(200, $content.Length - $contextStart)
    $surroundingContext = $content.Substring($contextStart, $contextLength)
    
    # Check if surrounding context matches excluded patterns
    if (Is-ExcludedContext -text $surroundingContext) {
        return $false
    }
    
    # Check whitelist patterns
    foreach ($whitePattern in $whitelistPatterns) {
        $escapedPattern = [regex]::Escape($whitePattern)
        $escapedMatch = [regex]::Escape($match)
        if ($content -match "(?s)$escapedPattern.*?\b$escapedMatch\b") {
            return $false
        }
    }
    
    return $true
}

function Is-ExcludedContext {
    param (
        [string]$text
    )
    return $text -match $excludedRegex
}


# Initialize scan statistics
$scanStats = @{
    StartTime = Get-Date
    TotalFiles = 0
    ScannedFiles = 0
    MatchesFound = 0
    ErrorCount = 0
    Errors = @()
}

# Create progress bar
$progressParams = @{
    Activity = "Scanning files for suspicious patterns"
    Status = "Initializing..."
    PercentComplete = 0
}

# Output the project folder path
Write-Host "Starting scan in path: '$projectFolderPath'" -ForegroundColor Green
Write-Host "Initializing scan..." -ForegroundColor Yellow

# Define a central list of excluded patterns
$excludedPatterns = @(
    'composer', 'autoload', 'vendor', 'cache', 'generated', 
    'test', 'mock', 'example', 'package', 'namespace', 
    'class', 'function', 
    '^\s*//',       # Single-line comments starting with //
    '\*',           # Block comments 
    '^\s*\*',       # Line starting with * (often used in block comments)
    '\s*if\s*\(',   # If conditions
    '\s*=\s*\(',    # Assignment operations
    'return\s+'    # Return statements
)

# Convert to a regex pattern (case-insensitive)
$excludedRegex = "(?i)(" + ($excludedPatterns -join '|') + ")"

# Get and cache the list of files to scan
$files = Get-ChildItem -Path $projectFolderPath -Recurse -Include *.java, *.php, *.cs, *.html, *.js, *.py, *.go, *.cpp, *.c, *.h, *.hpp

# Set total files count
$scanStats.TotalFiles = $files.Count

# Process files using the cached list
$files | ForEach-Object {
    $filePath = $_.FullName
    $scanStats.ScannedFiles++
    
    # Update progress bar
    $progressParams.Status = "Scanning $($_.Name)"
    $progressParams.PercentComplete = ($scanStats.ScannedFiles / $scanStats.TotalFiles * 100)
    Write-Progress @progressParams
    
    try {
        if (Is-ExcludedContext -text $filePath) {
            return
        }
        
        $fileLines = Get-Content -Path $filePath -ErrorAction Stop
        $fileContent = $fileLines -join "`n"
        $metadata = Get-FileMetadata -filePath $filePath
        
        foreach ($patternGroup in $patterns) {
            $vulnerabilityType = $patternGroup.Type
            
            foreach ($pattern in $patternGroup.Patterns) {
                # Use regex to find all matches with their positions
                $regex = [regex]$pattern
                $matches = $regex.Matches($fileContent)
                
                foreach ($match in $matches) {
                    if (Test-ValidContext -content $fileContent -match $match.Value -whitelistPatterns $patternGroup.Whitelist) {
                        # Calculate the correct line number
                        $matchPosition = $match.Index
                        $lineNumber = ($fileContent.Substring(0, $matchPosition) -split '\r?\n').Count
                        
                        $contextStart = [Math]::Max(0, $match.Index - 100)
                        $contextLength = [Math]::Min(200, $fileContent.Length - $contextStart)
                        $context = $fileContent.Substring($contextStart, $contextLength)
                        
                        if (-not (Is-ExcludedContext -text $context)) {
                            $matchObject = [PSCustomObject]@{
                                FilePath = $filePath
                                FileName = Split-Path $filePath -Leaf
                                VulnerabilityType = $vulnerabilityType
                                Pattern = $pattern
                                LineNumber = $lineNumber  # Accurate line number calculation
                                LineText = $fileLines[$lineNumber - 1].Trim()  # Get the actual line text
                                Context = $context
                                Metadata = $metadata
                                MatchValue = $match.Value
                                Severity = switch ($vulnerabilityType) {
                                    "Shellcode Patterns" { "High" }
                                    "Injection Functions" { "High" }
                                    "Webshell Functions" { "Critical" }
                                    "Math Pattern" { "Medium" }
                                    "Webshell via File Upload" { "Low" }
                                    default { "Low" }
                                }
                                RiskScore = switch ($vulnerabilityType) {
                                    "Shellcode Patterns" { 8 }
                                    "Injection Functions" { 9 }
                                    "Webshell Functions" { 10 }
                                    "Math Pattern" { 6 }
                                    "Webshell via File Upload" { 4 }
                                    default { 4 }
                                }
                            }
                            
                            $allMatches += $matchObject
                            $scanStats.MatchesFound++
                        }
                    }
                }
            }
        }
    }
    catch {
        $scanStats.ErrorCount++
        $scanStats.Errors += [PSCustomObject]@{
            FilePath = $filePath
            Error = $_.Exception.Message
        }
        Write-Warning "Error processing file $filePath : $($_.Exception.Message)"
    }
}

# Complete the progress bar
Write-Progress @progressParams -Completed

# Calculate scan statistics
$scanStats.EndTime = Get-Date
$scanStats.Duration = $scanStats.EndTime - $scanStats.StartTime
$scanStats.MatchesByType = $allMatches | Group-Object -Property VulnerabilityType | 
    Select-Object @{N='Type';E={$_.Name}}, @{N='Count';E={$_.Count}}

# Create summary report
$summary = @"
Scan Summary Report
==================
Scan Start Time: $($scanStats.StartTime)
Scan End Time: $($scanStats.EndTime)
Duration: $($scanStats.Duration.ToString())
Total Files: $($scanStats.TotalFiles)
Files Scanned: $($scanStats.ScannedFiles)
Matches Found: $($scanStats.MatchesFound)
Errors Encountered: $($scanStats.ErrorCount)

Matches by Vulnerability Type:
$($scanStats.MatchesByType | ForEach-Object { "$($_.Type): $($_.Count)" })

High Risk Findings (Score >= 8):
$($allMatches | Where-Object { $_.RiskScore -ge 8 } | 
    Select-Object -First 10 | 
    ForEach-Object { "- [$($_.Severity)] $($_.FilePath): $($_.VulnerabilityType)" })
"@

# Generate detailed HTML report
$htmlReport = @"
<!DOCTYPE html>
<html>
<head>
    <title>Security Scan Report - $folderName</title>
    <style>
        body { font-family: Arial, sans-serif; margin: 20px; }
        .header { background-color: #f5f5f5; padding: 20px; border-radius: 5px; }
        .summary { margin: 20px 0; }
        .findings { margin: 20px 0; }
        .finding { border: 1px solid #ddd; padding: 10px; margin: 10px 0; border-radius: 5px; }
        .high { border-left: 5px solid #CC0000; }
        .medium { border-left: 5px solid #ffbb33; }
        .low { border-left: 5px solid #00C851; }
        .critical { border-left: 5px solid #9932CC; }
        pre { background-color: #f8f9fa; padding: 10px; border-radius: 3px; overflow-x: auto; }
        .stats { display: flex; justify-content: space-between; flex-wrap: wrap; }
        .stat-box { background-color: #f8f9fa; padding: 15px; border-radius: 5px; margin: 5px; min-width: 200px; }
    </style>
</head>
<body>
    <div class="header">
        <h1>Security Scan Report</h1>
        <p>Project: $folderName</p>
        <p>Scan Date: $($scanStats.StartTime)</p>
    </div>

    <div class="summary">
        <h2>Scan Statistics</h2>
        <div class="stats">
            <div class="stat-box">
                <h3>Total Files</h3>
                <p>$($scanStats.TotalFiles)</p>
            </div>
            <div class="stat-box">
                <h3>Files Scanned</h3>
                <p>$($scanStats.ScannedFiles)</p>
            </div>
            <div class="stat-box">
                <h3>Matches Found</h3>
                <p>$($scanStats.MatchesFound)</p>
            </div>
            <div class="stat-box">
                <h3>Errors</h3>
                <p>$($scanStats.ErrorCount)</p>
            </div>
        </div>
    </div>

    <div class="findings">
        <h2>Findings</h2>
        $(
            $allMatches | Sort-Object -Property RiskScore -Descending | ForEach-Object {
                @"
                <div class="finding $($_.Severity.ToLower())">
                    <h3>[$($_.Severity)] $($_.VulnerabilityType)</h3>
                    <p><strong>File:</strong> $($_.FilePath)</p>
                    <p><strong>Risk Score:</strong> $($_.RiskScore)/10</p>
                    <p><strong>Pattern:</strong> $($_.Pattern)</p>
                    <p><strong>Line Number:</strong> $($_.LineNumber)</p>
                    <p><strong>Context:</strong></p>
                    <pre>$($_.Context)</pre>
                </div>
"@
            }
        )
    </div>

    <div class="errors" style="margin-top: 20px;">
        <h2>Errors</h2>
        $(
            if ($scanStats.Errors.Count -gt 0) {
                $scanStats.Errors | ForEach-Object {
                    "<div class='finding low'><p><strong>File:</strong> $($_.FilePath)</p><p><strong>Error:</strong> $($_.Error)</p></div>"
                }
            } else {
                "<p>No errors encountered during scan.</p>"
            }
        )
    </div>
</body>
</html>
"@

# Save results
$summary | Out-File -FilePath $outputFilePath
$htmlReport | Out-File -FilePath "$folderName-report.html"
$allMatches | ConvertTo-Json -Depth 10 | Out-File -FilePath $jsonOutputPath
$allMatches | Export-Csv -Path $csvOutputPath -NoTypeInformation

# Display completion message with color coding
Write-Host "`nScan completed!" -ForegroundColor Green
Write-Host "Summary saved to: $outputFilePath" -ForegroundColor Yellow
Write-Host "HTML report saved to: $folderName-report.html" -ForegroundColor Yellow
Write-Host "JSON results saved to: $jsonOutputPath" -ForegroundColor Yellow
Write-Host "CSV results saved to: $csvOutputPath" -ForegroundColor Yellow

# Display quick summary
Write-Host "`nQuick Summary:" -ForegroundColor Cyan
Write-Host "=============" -ForegroundColor Cyan
Write-Host "Total files scanned: $($scanStats.ScannedFiles)" -ForegroundColor White
Write-Host "Total matches found: $($scanStats.MatchesFound)" -ForegroundColor White
Write-Host "Errors encountered: $($scanStats.ErrorCount)" -ForegroundColor White
Write-Host "`nHigh Risk Findings:" -ForegroundColor Red
$allMatches | Where-Object { $_.RiskScore -ge 8 } | 
    Select-Object -First 5 | 
    ForEach-Object { 
        Write-Host "- [$($_.Severity)] $($_.FilePath): $($_.VulnerabilityType)" -ForegroundColor Red
    }

# Create email report if findings exceed threshold
if ($scanStats.MatchesFound -gt 0) {
    $emailBody = @"
Security Scan Alert - High Risk Findings Detected

Project: $folderName
Scan Date: $($scanStats.StartTime)
Total Findings: $($scanStats.MatchesFound)

High Risk Findings:
$($allMatches | Where-Object { $_.RiskScore -ge 8 } | 
    Select-Object -First 10 | 
    ForEach-Object { "- [$($_.Severity)] $($_.FilePath): $($_.VulnerabilityType)" })

Please review the attached HTML report for complete details.
"@

    # Save email content for later use
    $emailBody | Out-File -FilePath "$folderName-email-alert.txt"
}

# Return scan results object
return @{
    Stats = $scanStats
    Matches = $allMatches 
    Summary = $summary
    ReportPath = "$folderName-report.html"
}