EncystPHP Privilege Escalation and SSH Persistence

Ethan Andrews@eandrews

•updated Feb 27, 2026•1•0•38

Detects two persistence techniques used by EncystPHP: the creation of backdoored root-level accounts and the injection of SSH keys into user accounts. Specifically, it looks for 'useradd' commands creating accounts with UID 0 and specific generic usernames, and modifications to '.ssh/authorized_keys' files by non-root/non-sshd processes.