OWASP mod_security to help /tmp execution

Hi there.

Is there a specific rule that I could enable to help harden the /tmp folder found in each of my clients child cpanel accounts? Such as

Code:

/home/user/tmp

Hackers are uploading a trojan shell in those tmp folders for many of my clients, and then executing it inside of it.

I have researched it like crazy, and even tried mounting it as

Code:

noexec,nosuid

But as this guide says, that isn't even enough.

So I was hoping OWASP rules could help.

Thank you.