setenforce

Sets whether SELinux is enforcing (1) or permissive (0). toybox

On Linux 1 Sigma rule name it

Linux

from the toybox, 0BSD

setenforce [enforcing|permissive|1|0]

Toggle SELinux between enforcing and permissive modes. To enable or disable SELinux, edit /etc/selinux/config instead.

Put SELinux in enforcing mode

setenforce 1Identify

Put SELinux in permissive mode

setenforce 0Identify

Trips 1 Sigma rule: mediumDisabling Security Tools by Ömer Günal, Alejandro Ortuno, oscd.community

Sigma process creation rules that name setenforce

mediumDisabling Security ToolsÖmer Günal, Alejandro Ortuno, oscd.community