According to SOAR, the following detection techniques may be useful:
Highly cost effective:
Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
Effectiveness: High