tail /var/log/auth.log
find . -type f -newermt 2017-01-01 ! -newermt 2017-01-31

grep -lr --include=*.php "base64_decode"
grep -lr --include=*.php "@require"