I'm looking for a monitoring service which look for suspicious writing on disk.
Let's say that I have a PHP/Ruby/Python website running on my server, and there is a vulnerability on my website. An attacker can upload/modify any file owned by the apache/nginx user.
Is there any service that can say : "Hey a modification has been made on index.php. It's weird because this file was never modified since its creation."
Or "Hey, there is a new file at /img/reverse.php what is a .php file is doing on /img".