System Warning: New file added

Yes, that is what it means.

The entries in the log with the user system are the ones initiated by the website itself, without user interaction. To keep the same format as the other logs, the plugin uses the IP 127.0.0.1; so yes, your assumption that “[…] these files have been added by a locally running process or by my hosting provider” is correct.

Someone used FTP, SSH or the file manager available in your hosting account to create them, or the server itself created them; since this operation was performed outside of WordPress, the plugin has no way to know who exactly created them nor how, hence the use of the ambiguous “system — 127.0.0.1” references.

Marking as resolved, feel free to re-open if you need more information.

What are the criteria that Sucuri uses to identify ‘new files added?’

There are two criteria for two different tools.

WordPress Integrity

The integrity tool obtains a copy of the files included in the version of WordPress that you have installed from a public API service maintained by the WordPress organization. The plugin scans your project, and for every file that is not in the list obtained from the API it flags them as new/added.

Audit Logs

The plugin scans your entire project the first time you generate the API key, and assuming that your website is clean at the moment, it sends the list to the Sucuri API service. For every subsequent scan the plugin checks which files are currently in your project against the list of files that were sent to the API the first time, any difference is reported in the audit logs.

Flagged Files with Old Dates

Every file system has a metadata entry to store information about a file, this includes the size, modification date, parent directory, etc. It is fairly easy to change these dates with utilities like the touch command in Unix. Below you can find an example that I took from my Mac computer:

$ echo "" 1> file.txt
$ ls -lhias -- file.txt
  1B Sep 05 10:06 file.txt
$ touch -t 199910311503 -- file.txt
$ ls -lhias -- file.txt
  1B Oct 31  1999 file.txt

Notice how I created a new file on September 05 at 10:06 am, and later used the touch command to change the date to October 31, 1999 at 03:03 pm. Because there is no way to prevent this from a high level as it is with PHP, the plugin can simply show whatever the file system is reporting, a malicious user can create new files in your website and make them pass as old files to mislead. There is no way to explain this to the regular users in an easy way, so we just show the date for simplicity, but technically speaking, the date should be removed as it adds just to the confusion.

Let me know if you need more information.