← All Binaries

csrutil

Used to enable/disable SIP, configure netboot and authenticated-root settings

Author: Megan Carney (https://infosec.exchange/@PwnieFan) Created: 2023-05-14

Defense Evasion Reconnaissance Discovery users configuration

Paths

/usr/bin/csrutil

Example Use Cases

Disable SIP

disable SIP (System Integrity Protection) - requires booting into recovery mode

csrutil disable

Defense Evasion users

Disable authenticated-root

When authenticated-root is disabled, booting is allowed from non-sealed system snapshots - requires booting into recovery mode

csrutil authenticated-root disable

Defense Evasion users

Add a netboot server

Insert a new IPv4 address in the list of allowed NetBoot sources

csrutil netboot add <address>

Defense Evasion configuration

Map infrastructure

List allowed NetBoot sources

csrutil netboot list

Reconnaissance Discovery configuration

Determine if SIP is enabled

Determine if System Integrity Protection is enabled

csrutil status

Detections

Resources