macOS csrutil SIP Status Enumeration via process command line

Flags execution of "csrutil status" on macOS to enumerate System Integrity Protection state.

FreeUnreviewedSigmalowv1

macos-csrutil-sip-status-enumeration-via-process-command-line-53821412

title: macOS csrutil SIP Status Enumeration via process command line
id: 5a4c79c5-28aa-42a8-ad08-f6044b61b5b4
status: test
description: This rule identifies macOS process executions of csrutil where the command line contains the keyword "status". Attackers use SIP status checks during post-exploitation to understand local security protections before attempting further actions. Telemetry required is process creation events including the executable path and full command line.
references:
  - https://ss64.com/osx/csrutil.html
  - https://objective-see.org/blog/blog_0x6D.html
  - https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/
  - https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_status.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2024-01-02
tags:
  - attack.discovery
  - attack.t1518.001
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith: /csrutil
    CommandLine|contains: status
  condition: selection
falsepositives:
  - Legitimate administration activities
level: low
license: DRL-1.1
related:
  - id: 53821412-17b0-4147-ade0-14faae67d54b
    type: derived

What it detects

This rule identifies macOS process executions of csrutil where the command line contains the keyword "status". Attackers use SIP status checks during post-exploitation to understand local security protections before attempting further actions. Telemetry required is process creation events including the executable path and full command line.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.