lambsys malware disabling AppArmor and SELinux security controls

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•2

Detects attempts to disable or modify critical Linux security subsystems including SELinux and AppArmor. The rule monitors for the execution of commands such as setenforce, aa-teardown, and systemctl, or direct modifications to security configuration files.