auditctl -w /home/magento/app/Mage.php -p wa -k mage_malware

ausearch -k mage_malware | aureport -f -i


File Report
===============================================
# date time file syscall success exe auid event
===============================================
1. 05/24/2019 16:09:34 /home/magento/app/Mage.php open yes /usr/sbin/nginx unset 324771