{"id":"53821412-17b0-4147-ade0-14faae67d54b","title":"System Integrity Protection (SIP) Enumeration","description":"Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios.\n","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"low","date":"2024-01-02","modified":"","tags":["attack.discovery","attack.t1518.001"],"technique_ids":["T1518.001"],"logsource":{"product":"macos","category":"process_creation"},"falsepositives":["Legitimate administration activities"],"references":["https://ss64.com/osx/csrutil.html","https://objective-see.org/blog/blog_0x6D.html","https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/","https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior"],"source_path":"rules/macos/process_creation/proc_creation_macos_csrutil_status.yml","source_sha256":"b80e7e9dab586a599a11a5f1c9099a8a4a70f8e10bbd28e7e96aeab7c6f3548a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_csrutil_status.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: System Integrity Protection (SIP) Enumeration\nid: 53821412-17b0-4147-ade0-14faae67d54b\nstatus: test\ndescription: |\n    Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios.\nreferences:\n    - https://ss64.com/osx/csrutil.html\n    - https://objective-see.org/blog/blog_0x6D.html\n    - https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/\n    - https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2024-01-02\ntags:\n    - attack.discovery\n    - attack.t1518.001\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    # VT Query: behavior_processes:\"csrutil status\" p:5+ type:mac\n    selection:\n        Image|endswith: '/csrutil'\n        CommandLine|contains: 'status'\n    condition: selection\nfalsepositives:\n    - Legitimate administration activities\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1518.001","id":"T1518.001","name":"Security Software Discovery","page":"techniques/enterprise/T1518.001/"}],"data_path":"data/detection-rules/53821412-17b0-4147-ade0-14faae67d54b.json","kind":"sigma"}