YARA (https://virustotal.github.io/yara/) is a pattern-matching Swiss army knife for malware detection. YARA rules consist of the descriptions of malware characteristics based on textual or binary patterns. YARA can be used to perform malware detection, and the detection signatures can also be easily defined. The YARA scanner/rules can be seen as an antivirus scanner and signatures.
For example, say that one host identifies suspicious webshell activities, but the antivirus software does not detect any suspicious activities. The security administrator can use the YARA detector with predefined YARA rules to scan all the files on the host or to scan the collected logs. Here is one example of a YARA rule to detect the web shell:
rule php_webshell : webshell
{
meta:
description = “This is a sample of a PHP webshell detection...