Maybe some analysis of odd patterns in entropy of binary files committed to repositories could pick out some to look at a bit deeper?