Disables AppArmor Mandatory Access Control

Stops or disables AppArmor via systemctl, removing mandatory access control restrictions on process capabilities and file access.

Creates/modifies Cron job

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Creates/modifies environment variables

Creating/modifying environment variables is a common persistence mechanism.

Disables SELinux

Disables SELinux security module.

Enumerates running processes

Discovers information about currently running processes on the system

Modifies systemd

Adds/ modifies systemd service files. Likely to achieve persistence.

Modifies Bash startup script