Webshells/WShell_Drupalgeddon2_icos.yar has been added in order to detect *.ico webshells from Drupalgeddon2 vuln. An attack's write up can be found here https://rankinstudio.com/Drupal_ico_index_hack.