Adversaries may modify file or directory permissions to evade defenses.

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

Flushes/ disables firewall rules inside the Linux kernel.

Loads a Linux kernel module, potentially to achieve persistence

Writes data to DNS resolver config file.

Modifies inode attributes on the filesystem to allow changing of immutable files.

Checks DMI information which indicate if the system is a virtual machine.

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Deletes log files on the system.

Disables AppArmor security module.

Disables SELinux security module.

Adding/modifying system rc scripts is a common persistence mechanism.

Accesses system info like serial numbers, manufacturer names etc.

Detects executables packed with UPX/modified UPX open source packer.