SELinux Disabled - *nix [splunk-unix]

Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems. This use case detects when the setenforce command was used to disable SELinux, a security module integrated into the Linux kernel that enforces mandatory access control (MAC) policies.