System Integrity Protection (SIP) Enumeration

SigmaHQ Detections@sigmaHQ

•updated Nov 1, 2024•0•0•0

Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios.