Landlock is a Linux Security Module integrated since kernel 5.13 that creates application sandboxes for defense-in-depth. The SekoiaTDR team explores Landlock's value for detection engineering, noting that audit logging of restriction violations provides low-false-positive threat detection opportunities since violations indicate misuse of hardened applications.