Adversaries may modify file or directory permissions to evade defenses.

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

Flushes/ disables firewall rules inside the Linux kernel.

Loads a Linux kernel module, potentially to achieve persistence

Adversaries may attempt to dump credentials to use it in password cracking.

Modifies inode attributes on the filesystem to allow changing of immutable files.

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Deletes log files on the system.

Disables AppArmor security module.

Disables SELinux security module.

Adds/modifies system service, likely for persistence.

Adding/modifying system rc scripts is a common persistence mechanism.