YARA

YARA is an open-source tool and rule language for describing files by the strings, byte patterns and conditions they contain. Rules are widely shared among security teams and built into many scanning and EDR products.

For web shells, YARA is used to sweep web roots, backups and disk images for suspicious combinations — such as request input flowing into dynamic evaluation, or process execution in a page that reads request data. Good rules combine weak signals and are tested against clean code to control false positives. See YARA and Sigma rules.