diff --git a/definitions/patterns_raw.txt b/definitions/patterns_raw.txt
index 3905abe..2165fa3 100644
--- a/definitions/patterns_raw.txt
+++ b/definitions/patterns_raw.txt
@@ -348,4 +348,8 @@ php_uname()
 # decode content with basic rot13
 str_split(rawurldecode(str_rot13(
 # generating PHP file name to put content
-substr(md5(time()), 0, 8) . ".php"
\ No newline at end of file
+substr(md5(time()), 0, 8) . ".php"
+
+# webshell
+0byt3m1n1
+ZeroByte
\ No newline at end of file