Malware keeps being uploaded to my core files

Hi,

I’m a newbie to your plugin. I started using it when my host contacted me that a malware “temp1-1.php”, I guess a backdoor, keeps being uploaded to my site. Your plugin makes it easy for me to delete. However, I can’t find out which file or plugin is the exploit. It’s been uploaded to my core files around 6 times now in the last month and a half. Until I find out where this file is coming from and to stop it, is there any way to get an alert when it is uploaded to my core files? I check obsessively the Sucuri plugin several times a day; it’s getting tiring. Thank you!