Aggressive File Permission Lockout (chmod 000)
Detects the use of 'chmod 000' on PHP files within common web root directories. This technique is used by threats like the EncystPHP web shell to make malicious files unreadable, unwritable, and non-executable, effectively locking them to prevent inspection or removal.
Sigma
