# csrutil

> Configure or view system security policies.

Used to enable/disable SIP, configure netboot and authenticated-root settings

- Page: https://loobins.io/binaries/csrutil/
- Author: Megan Carney (https://infosec.exchange/@PwnieFan)
- Created: 2023-05-14
- Tactics: Reconnaissance, Defense Evasion, Discovery

## Paths

- `/usr/bin/csrutil`

## Example Use Cases

### Disable SIP

disable SIP (System Integrity Protection) - requires booting into recovery mode

```bash
csrutil disable
```

- Tactics: Defense Evasion
- Tags: users

### Disable authenticated-root

When authenticated-root is disabled, booting is allowed from non-sealed system snapshots - requires booting into recovery mode

```bash
csrutil authenticated-root disable
```

- Tactics: Defense Evasion
- Tags: users

### Add a netboot server

Insert a new IPv4 address in the list of allowed NetBoot sources

```bash
csrutil netboot add <address>
```

- Tactics: Defense Evasion
- Tags: configuration

### Map infrastructure

List allowed NetBoot sources

```bash
csrutil netboot list
```

- Tactics: Reconnaissance, Discovery
- Tags: configuration

### Determine if SIP is enabled

Determine if System Integrity Protection is enabled

```bash
csrutil status
```

- Tactics: Discovery

## Detections

- [Sigma: System Integrity Protection (SIP) Disabled](https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_disable.yml)
- [Sigma: System Integrity Protection (SIP) Enumeration](https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_status.yml)

## Resources

- [Discussion on how SIP interacts with bless and netboot](https://developer.apple.com/forums/thread/4002)
- [MITRE ATT&CK T1518.001 Software Discovery: Security Software Discovery](https://attack.mitre.org/techniques/T1518/001/)
- [The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSSBackdoor Planting in Safari, and LeveragesTwo Zero-day Exploits](https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf)