Description: Detects suspicious code patterns commonly used by malware (obfuscation, eval chains, backdoors).

How it works: The heuristic engine analyzes file contents and assigns suspicion based on signatures and indicators.

How to access / configure:

1. WP Admin → AegisShield → Malware Scan.
2. Run a scan.
3. Review the report for suspect indicators and file paths.

Recommended setting: Treat PHP files in uploads as high risk; verify against known-good sources.