How to detect if your server is compromised with a cryptocurrency (Monero) miner?

I run a server with many small sites from wordpress to drupal to other cms. How can I detect if these sites are infected by a cryptocurrency miner like monero?

Instead of defacing sites, its best to keep these comprised sites low-key and keep these monero miners running. What are some things I should grep for to detect common string patterns in files to see if a miner exists or not?