You can trying using auditd to audit the file.sudo apt-get install auditd
Running sudo auditctl -l by default show no rules
Create a temporary rule to audit changes to index.phpsudo auditctl -w /var/www/html/index.php -p rwxa # -p = read, write, execute, attributes
Run sudo auditctl -l will show the rule that was created.
Now run sudo ausearch -f index.php | more to show what's touching index.php
or sudo tail -f /var/log/audit/audit.log | grep index.php.