System Integrity Protection (SIP) Disabled

SigmaHQ Detections@sigmaHQ

•updated Nov 1, 2024•0•0•1

Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios.