System Integrity Protection (SIP) Disabled via csrutil

SigmaHQ Detections@sigmaHQ

•updated Nov 1, 2024•0•20

Detects when the `csrutil` command is used with the `disable` argument to turn off System Integrity Protection (SIP) on macOS. This action is often performed in post-exploitation scenarios by adversaries to gain greater control over the system or to bypass security mechanisms.