Track Changes to Theme Files

Hello all.

I’ve been struggling with a recent hack that seems to be a link injection. I’ve located a number of malicious files, deleted them, and implemented many of the commonly recommended security measures.

However, it seems that I might not have rooted out a bad user since there are many accounts on the site, and it appears that whomever is doing this might be accessing my theme files directly.

I’m just wondering if anyone knows of a plugin like Audit Trail that tracks changes to core and theme files instead of just posts/pages.

Any help would be much appreciated.