System Integrity Protection (SIP) Enumeration — Detection Rule

Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios.