AppArmor Profile Removal

Danny Y@zendannyy

•updated Apr 26, 2026•1•0•114

This rule detects attempts to remove AppArmor profiles on Linux systems. AppArmor is a Linux security module that allows system administrators to restrict program capabilities with per-program profiles. An adversary might attempt to remove or disable AppArmor profiles to bypass restrictions and perform unauthorized actions.