We have a Linux server at a large hosting provider that has approximately 75 Joomla! websites being hosted on it. We use maldet to scan daily for possible malware on all these sites. In the last week or so, files have been showing up in /tmp
/tmp/20130930-202240-UkpAAEBaJ74AABlPLiMAAAAL-file-cdQfYQ /tmp/20131001-004117-Ukp8nUBaJ74AAGD@-W0AAAAD-file-P6KfRr /tmp/20131001-004128-Ukp8qEBaJ74AAGEdQ88AAAAI-file-W65Hp6
They are owned by the user apache runs as, and they contain malicious encoded PHP code. We would like to find out which site, or sites, are being attacked. We need to know where or how these files are being created from. Obviously, just 1 user account controls all those sites, so that makes things difficult to narrow down.
Is there anyway to audit Apache and determine which website these files are being created from?