SELinux Disabling Attempt Indicators

Rule Info

Name
SELinux Disabling Attempt Indicators
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects indicators of SELinux disabling via command line arguments. This includes attempts to modify the SELinux configuration file as well as runtime changes to the SELinux enforcement mode. This is a common post-exploitation technique to persistently disable SELinux across reboots, reducing mandatory access control enforcement and evading security controls.
Reference
https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/using_selinux/changing-selinux-states-and-modes_using-selinux
Date
2026-10-06 00:00:00
Modified
None
Id
a8b4e721-3c1f-4d09-b7e2-9f5c083a6d4e
Tags
attack.defense-impairment attack.t1685
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022