A server under my management was attacked by a bunch of hackers and there were a lot of hacked wordpress sites from hackers but hackers knows the some professional tools to hide there identity.
Once we know that more than one sites are hacked,We used a command like this to find all files with hackers signature.
[success]find . -type f -name “index.*” -print0 | xargs -0 grep -l “HACKED BY YAMRAAJ”[/success]