you can check general access log, nginx/apache, some connections you can see there.
or
configure auditctl to log:
auditctl -w /home/magento/app/Mage.php -p wa -k mage_malware
then check whats going on:
ausearch -k mage_malware | aureport -f -i
File Report
===============================================
# date time file syscall success exe auid event
===============================================
1. 05/24/2019 16:09:34 /home/magento/app/Mage.php open yes /usr/sbin/nginx unset 324771