System Integrity Protection (SIP) Disabled
A Sigma rule for process creation on macOS, by Joseliyo Sanchez, @Joseliyo_Jstnk.
medium 1 ATT&CK technique 1 program it names 1 everyday example trips it
What it looks for
detection:
selection:
CommandLine|contains: 'disable'
Image|endswith: '/csrutil'
condition: selection
The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Joseliyo Sanchez, @Joseliyo_Jstnk, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.
Command lines that trip it
Programs and files it names
ATT&CK
T1518.001Software Discovery: Security Software Discovery