csrutil

disable SIP (System Integrity Protection) - requires booting into recovery mode

csrutil disable

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Defense Evasion

Detection

Sigma: System Integrity Protection (SIP) Disabled: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_disable.yml

Sigma: System Integrity Protection (SIP) Enumeration: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_status.yml

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/csrutil.yml

developer.apple.com/forums/thread/4002

attack.mitre.org/techniques/T1518/001/

documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf

When authenticated-root is disabled, booting is allowed from non-sealed system snapshots - requires booting into recovery mode

csrutil authenticated-root disable

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Defense Evasion

Detection

Sigma: System Integrity Protection (SIP) Disabled: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_disable.yml

Sigma: System Integrity Protection (SIP) Enumeration: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_status.yml

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/csrutil.yml

developer.apple.com/forums/thread/4002

attack.mitre.org/techniques/T1518/001/

documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf

Insert a new IPv4 address in the list of allowed NetBoot sources

csrutil netboot add <address>

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Defense Evasion

Detection

Sigma: System Integrity Protection (SIP) Disabled: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_disable.yml

Sigma: System Integrity Protection (SIP) Enumeration: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_status.yml

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/csrutil.yml

developer.apple.com/forums/thread/4002

attack.mitre.org/techniques/T1518/001/

documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf

List allowed NetBoot sources

csrutil netboot list

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Reconnaissance, Discovery

Detection

Sigma: System Integrity Protection (SIP) Disabled: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_disable.yml

Sigma: System Integrity Protection (SIP) Enumeration: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_status.yml

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/csrutil.yml

developer.apple.com/forums/thread/4002

attack.mitre.org/techniques/T1518/001/

documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf

Determine if System Integrity Protection is enabled

csrutil status

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

Sigma: System Integrity Protection (SIP) Disabled: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_disable.yml

Sigma: System Integrity Protection (SIP) Enumeration: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_status.yml

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/csrutil.yml

developer.apple.com/forums/thread/4002

attack.mitre.org/techniques/T1518/001/

documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf