lambsys AppArmor and SELinux Disable via systemctl/setenforce/aa-teardown
Detects attempts by a user or process to disable or modify Linux kernel-level mandatory access control mechanisms, specifically SELinux and AppArmor. Such actions are commonly performed by adversaries to reduce system security posture and facilitate further malicious activity by bypassing enforced containment policies.
SentinelOne
