Elastic medium stable eql

Suspicious SIP Check by macOS Application

Detects the unusual use of csrutil by a macOS application to check System Integrity Protection (SIP) status. While not malicious in itself, this activity is highly indicative of malware verifying it is not running in a virtual machine or protected environment prior to executing its payload.

View Source

Detection Logic

process where host.os.type == "macos" and event.type == "start" and event.action == "exec" and
  process.command_line like "*csrutil*status*" and
  process.command_line like "*enabled*" and
  (process.parent.executable like "/*.app/*" or
   process.parent.executable like "/Applications/*.app/*" or
   process.parent.executable like "/Volumes/*.app/*") and
  not process.parent.executable == "/Library/Application Support/Mosyle/MosyleMDM.app/Contents/MacOS/MosyleMDM"

Field Validations

Loading…

Comments (0)

Loading comments...