For a while, I’m going to check the `/home` directory daily for files modified within the last 24 hours. Since my server has relatively few users but receives a high number of attacks, I’m more likely to notice suspicious activity. If I find anything suspicious, I’ll share it here.
This is the command I’m using:
find /home -type f -cmin -1440
-printf '%TY-%Tm-%Td %TH:%TM:%TS %p\n' 2>/dev/null |
grep -v 'sess_' |
sort -r