MAC-SIP-DISABLEDefense Evasion

SIP Disable (Recovery)

Boot into recoveryOS, csrutil disable — full root with no kernel restrictions. Requires physical access on Apple Silicon.

§ Where this technique fits

MAC-SIP-DISABLE is catalogued under the Defense Evasion tactic of the offensive-security kill-chain. It appears in 0 approved dossiers in the registry, typically.