tail /var/log/auth.log find . -type f -newermt 2017-01-01 ! -newermt 2017-01-31 grep -lr --include=*.php "base64_decode" grep -lr --include=*.php "@require"