I need to understand the log below, my index.php got obfuscated code, and file permissions changed from 644 to 755 as well.
I've got something in my audit but can't really tell what and how it happened. Log is below (I took out everything but the index.php related lines).
----
time->Sun Mar 31 17:19:20 2019
type=PROCTITLE msg=audit(1554067160.319:12831615): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067160.319:12831615): item=0 name="/home/usersite/public_html/index.php" inode=576615421 dev=09:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067160.319:12831615): cwd="/home/usersite"
type=SYSCALL msg=audit(1554067160.319:12831615): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae5540 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13524 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:20 2019
type=PROCTITLE msg=audit(1554067160.335:12831626): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067160.335:12831626): item=0 name="/home/usersite/public_html/index.php" inode=576615421 dev=09:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067160.335:12831626): cwd="/home/usersite"
type=SYSCALL msg=audit(1554067160.335:12831626): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae5540 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13526 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:20 2019
type=PROCTITLE msg=audit(1554067160.996:12832312): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067160.996:12832312): item=0 name="/home/usersite/public_html/index.php" inode=576615421 dev=09:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067160.996:12832312): cwd="/home/usersite"
type=SYSCALL msg=audit(1554067160.996:12832312): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae5540 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13531 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:23 2019
type=PROCTITLE msg=audit(1554067163.223:12837949): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067163.223:12837949): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067163.223:12837949): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067163.223:12837949): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13531 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.162:12834748): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.162:12834748): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.162:12834748): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.162:12834748): arch=c000003e syscall=2 success=yes exit=6 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13531 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.162:12834749): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.162:12834749): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.162:12834749): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.162:12834749): arch=c000003e syscall=2 success=yes exit=6 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13526 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.700:12836618): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.700:12836618): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.700:12836618): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.700:12836618): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13541 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.733:12836797): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.733:12836797): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.733:12836797): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.733:12836797): arch=c000003e syscall=2 success=yes exit=5 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13540 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----
time->Sun Mar 31 17:19:22 2019
type=PROCTITLE msg=audit(1554067162.766:12836929): proctitle=7068702D66706D3A20706F6F6C207765726F636B746865737065637472756D6B6174795F636F6D
type=PATH msg=audit(1554067162.766:12836929): item=0 name="/home/usersite/public_html/wp-content/themes/twentythirteen/index.php" inode=1135033766 dev=09:01 mode=0100644 ouid=1121 ogid=1123 rdev=00:00 obj=system_u:object_r:home_root_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1554067162.766:12836929): cwd="/home/usersite/public_html"
type=SYSCALL msg=audit(1554067162.766:12836929): arch=c000003e syscall=2 success=yes exit=6 a0=7ffea4ae3260 a1=0 a2=1b6 a3=4 items=1 ppid=9239 pid=13524 auid=4294967295 uid=1121 gid=1123 euid=1121 suid=1121 fsuid=1121 egid=1123 sgid=1123 fsgid=1123 tty=(none) ses=4294967295 comm="php-fpm" exe="/opt/cpanel/ea-php70/root/usr/sbin/php-fpm" subj=system_u:system_r:unconfined_service_t:s0 key="monitor-hosts"
----