app-armor-stopped

This query was originally published in the threat analytics report, Sysrv botnet evolution. Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency. The following query finds instances of the attacker attempting to stop the AppArmor network security service on devices running Linux.