AppArmor Profile Removed

Danny Y@zendannyy

•updated May 31, 2026•2•0•14

This rule detects attempts to remove AppArmor profiles. AppArmor is a Linux security module that allows system administrators to restrict program capabilities with per-program profiles. An adversary might attempt to remove or disable AppArmor profiles to bypass restrictions and perform unauthorized actions.