macos community v1.0.0

csrutil

Configure or view system security policies.

📋 Live Preview 
csrutil
csrutil

Sandbox: execFile · Timeout: 30s

Capabilities

security.defenseevasion.bypass
reconnaissance.enumerate
discovery.enumerate

Examples

Disable SIP: disable SIP (System Integrity Protection) - requires booting into recovery mode

csrutil disable

Disable authenticated-root: When authenticated-root is disabled, booting is allowed from non-sealed system snapshots - requires booting into recovery mode

csrutil authenticated-root disable

Add a netboot server: Insert a new IPv4 address in the list of allowed NetBoot sources

csrutil netboot add <address>

Map infrastructure: List allowed NetBoot sources

csrutil netboot list

Determine if SIP is enabled: Determine if System Integrity Protection is enabled

csrutil status

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_disable.yml Sigma: System Integrity Protection (SIP) Disabled
sigma https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_status.yml Sigma: System Integrity Protection (SIP) Enumeration

Documentation

Used to enable/disable SIP, configure netboot and authenticated-root settings

References