EncystPHP Aggressive File Permission Lockout
Detects the execution of 'chmod 000' against PHP files in common FreePBX/Elastix web server directories. This is a high-fidelity indicator of the EncystPHP web shell attempting to lock out administrators and prevent inspection of its malicious files.
Microsoft Sentinel (KQL)
