{"id":"3603f18a-ec15-43a1-9af2-d196c8a7fec6","title":"System Integrity Protection (SIP) Disabled","description":"Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios.\n","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"medium","date":"2024-01-02","modified":"","tags":["attack.discovery","attack.t1518.001"],"technique_ids":["T1518.001"],"logsource":{"product":"macos","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://ss64.com/osx/csrutil.html","https://objective-see.org/blog/blog_0x6D.html","https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/","https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior"],"source_path":"rules/macos/process_creation/proc_creation_macos_csrutil_disable.yml","source_sha256":"d4911967fa2f5fcf96b5bb5a3b3c84e1c3a0771da2d2e3ae3719a1571a1922d1","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_csrutil_disable.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: System Integrity Protection (SIP) Disabled\nid: 3603f18a-ec15-43a1-9af2-d196c8a7fec6\nstatus: test\ndescription: |\n    Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios.\nreferences:\n    - https://ss64.com/osx/csrutil.html\n    - https://objective-see.org/blog/blog_0x6D.html\n    - https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/\n    - https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2024-01-02\ntags:\n    - attack.discovery\n    - attack.t1518.001\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    # VT Query: behavior_processes:\"csrutil status\" p:5+ type:mac\n    selection:\n        Image|endswith: '/csrutil'\n        CommandLine|contains: 'disable'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1518.001","id":"T1518.001","name":"Security Software Discovery","page":"techniques/enterprise/T1518.001/"}],"data_path":"data/detection-rules/3603f18a-ec15-43a1-9af2-d196c8a7fec6.json","kind":"sigma"}