Adversaries may modify file or directory permissions to evade defenses.

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

Flushes/ disables firewall rules inside the Linux kernel.

Loads a Linux kernel module, potentially to achieve persistence

Abuse sudo or cached sudo credentials to execute code.

Modifies inode attributes on the filesystem to allow changing of immutable files.

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Disables AppArmor security module.

Disables SELinux security module.

Reads the list of currently loaded kernel modules, possibly to detect virtual environments.