Wordfence Rules.php malware injection

Hi,
I know this is not Wordfences direct fault, and I know this is not coming from wordfence.
However, at some point malware is being injected into the rules.php file in the wflogs folder.

I have downloaded a copy of the file, removed it, and then when it gets re-added, the same happens, eventually.
My guess is a plugin, or other source is injecting it.

My questions is – where do I go from here to identify it?
Is this of use to WF for their own reference!
etc.

Thanks, N