# Check SIP status csrutil status

When a Mac is suspected compromised: