How to analyze malicious web shell uploads in a web server

Question

I am investigating a potential web shell attack on a web server and need guidance on how to analyze and detect malicious uploads. Specifically:

• What are the common web shell file signatures and obfuscation techniques?
• How can I manually inspect logs and file system changes to identify web shells?
• What automated tools (e.g., ClamAV, YARA) can assist in detecting web shells?
  Any best practices for preventing such attacks in PHP, Apache, or NGINX would also be helpful.