OWASP mod_security to help /tmp execution

Hi there. Is there a specific rule that I could enable to help harden the /tmp folder found in each of my clients child cpanel accounts? Such as /home/user/tmp
Hackers are uploading a trojan shell in those tmp folders for many of my clients, and then executing it inside of it. I have researched it like crazy, and even tried mounting it as noexec,nosuid
But as