System Integrity Protection (SIP) Disabled — Detection Rule

Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios.