Adversaries may modify file or directory permissions to evade defenses.

Flushes/ disables firewall rules inside the Linux kernel.

Loads a Linux kernel module, potentially to achieve persistence

Abuse sudo or cached sudo credentials to execute code.

Modifies inode attributes on the filesystem to allow changing of immutable files.

Checks DMI information which indicate if the system is a virtual machine.

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Adds/ modifies systemd service files. Likely to achieve persistence.

Accesses system info like serial numbers, manufacturer names etc.

Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

Detects executables packed with UPX/modified UPX open source packer.