Adversaries may modify file or directory permissions to evade defenses.

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

Flushes/ disables firewall rules inside the Linux kernel.

Loads a Linux kernel module, potentially to achieve persistence

Abuse sudo or cached sudo credentials to execute code.

Modifies inode attributes on the filesystem to allow changing of immutable files.

Checks DMI information which indicate if the system is a virtual machine.

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Disables AppArmor security module.

Disables SELinux security module.

Accesses system info like serial numbers, manufacturer names etc.

Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

Detects executables packed with UPX/modified UPX open source packer.