The code that you found in your website is in fact malicious [1] and as you guessed in your original comment our plugin ignores the existence of the “wp-rss.php” file as well as other files that we consider irrelevant; you can see the complete list here [2].
Please do not rely entirely in our plugin for the security of your website. The plugin is a security suite meant to complement your existing security posture. It is expected that you have a system besides or above (like a firewall) to prevent the wide range of attacks that your website might suffer.
Also notice, even if we remove the exception of the “wp-rss.php” file, the plugin will not read its content, so it will never know if the file is infected or not. You will notice in the code that I linked below that a malicious user can also hide from the WordPress Integrity Checks by writing malware into a “503.php” file, or “404.php”, or “500.php” or even “wp-config.php” because the plugin ignores them all.
A solution to this problem is to pay close attention to the “Audit Logs”. If a malicious user is able to create/write/update a “wp-rss.php” or any of the files ignored by the core integrity tool, the modifications will still appear in the audit logs. Be sure to check that section if you suspect of a new attack.
[1] https://gist.github.com/anonymous/6b29c99d44e4f7e702d4ef9c302a173e
[2] https://github.com/Sucuri/sucuri-wordpress-plugin/blob/0d4189c/src/corefiles.php#L423-L447
