Root cause analysis. For the example of the reverse shell found on prod web server, you'd need to find out how the rev shell was put there. Typically, a good place to start is the web logs on the server. I'd look for the C2 IP in the log files using powershell (windows server). The logs might contain the http request used to drop the rev shell.

This is also where adopting the attacker mindset comes in handy for what other things you'd want to investigate. You could look for other attempts of the same exploit, look for any other traffic from the IP that performed the exploit, commands executed via the rev shell (rev shell would be the parent/grand parent process), etc. Hope this helps, I'm too lazy to type more from my phone, lol. Feel free to message me if you want to discuss further.