CmdID

CmdID / Commands

csrutil

Manage the System Integrity Protection configuration. tldr-pages

On macOS 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

macOS

from tldr-pages, CC BY 4.0

Display the System Integrity Protection status

csrutil statusIdentify

Trips 1 Sigma rule: lowSystem Integrity Protection (SIP) Enumeration by Joseliyo Sanchez, @Joseliyo_Jstnk

Disable the System Integrity Protection

csrutil disableIdentify

Trips 1 Sigma rule: mediumSystem Integrity Protection (SIP) Disabled by Joseliyo Sanchez, @Joseliyo_Jstnk

Enable the System Integrity Protection

csrutil enableIdentify

Display the list of allowed NetBoot sources

csrutil netboot listIdentify

Add an IPv4 address to the list of allowed NetBoot sources

csrutil netboot add ip_addressIdentify

Reset the System Integrity Protection status and clear the NetBoot list

csrutil clearIdentify

What detects it

Sigma process creation rules that name csrutil
mediumSystem Integrity Protection (SIP) DisabledJoseliyo Sanchez, @Joseliyo_Jstnk
lowSystem Integrity Protection (SIP) EnumerationJoseliyo Sanchez, @Joseliyo_Jstnk