Detect TCC Manipulation in CrowdStrike LogScale
Adversaries manipulate or abuse macOS Transparency, Consent, and Control (TCC) to grant malicious processes elevated permissions without user consent. TCC controls access to camera, microphone, Full Disk Access, Screen Recording, and other sensitive resources. Techniques include: directly modifying the TCC SQLite database, injecting into existing processes that already have TCC entitlements, exploiting the limited process list to find TCC-entitled processes to hijack, or abusing MDM configuration profiles. Phil Stokes documented multiple TCC bypass techniques used by macOS malware.
MITRE ATT&CK
- Technique
- T1548 Abuse Elevation Control Mechanism
- Sub-technique
- T1548.006 TCC Manipulation
- Canonical reference
- https://attack.mitre.org/techniques/T1548/006/
LogScale Detection Query
// T1548.006 — TCC Manipulation Detection
// Branch 1: TCC Database unauthorized file writes
#event_simpleName=FileOpenInfo OR #event_simpleName=WriteProcessMemory
| TargetFileName = /TCC\.db|com\.apple\.TCC/i
| ImageFileName != /\/tccd$|\/syspolicyd$|\/mdmclient$|\/System Preferences\.app/i
| table([_time, ComputerName, UserName, ImageFileName, TargetFileName, CommandLine])
| rename(field="ImageFileName", as="process_path")
| rename(field="TargetFileName", as="tcc_file")
| rename(field="CommandLine", as="cmdline")
| eval detection_type="TCC_DB_Unauthorized_Write"
// Branch 2: sqlite3 accessing TCC databases
| union [
#event_simpleName=ProcessRollup2
| ImageFileName = /\/sqlite3$/i
| CommandLine = /TCC\.db|com\.apple\.TCC|kTCCService/i
| table([_time, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName])
| rename(field="ImageFileName", as="process_path")
| rename(field="CommandLine", as="cmdline")
| eval detection_type="TCC_SQLite_Direct_Access"
]
// Branch 3: Suspicious child process from TCC-privileged apps
| union [
#event_simpleName=ProcessRollup2
| ParentBaseFileName = /^(Finder|Terminal|Preview|Safari|Mail|Calendar)$/i
| ImageFileName = /\/(python3?|perl|ruby|bash|sh|osascript|curl|nc)$/i
| table([_time, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ParentProcessId, TargetProcessId])
| rename(field="ImageFileName", as="process_path")
| rename(field="CommandLine", as="cmdline")
| eval detection_type="TCC_Privileged_Process_Spawn"
]
| groupBy([ComputerName, UserName, detection_type, process_path, cmdline], function=count(as=event_count))
| sort(field=event_count, order=desc)CrowdStrike LogScale (Humio) CQL detection for macOS TCC database manipulation. Uses Falcon endpoint telemetry events to identify three attack vectors: unauthorized writes to TCC.db by non-system processes (FileOpenInfo), sqlite3 direct access to TCC databases (ProcessRollup2 with sqlite3 and TCC arguments), and suspicious interpreter/shell processes spawned from TCC-privileged macOS applications that may indicate entitlement hijacking.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate macOS system administrators using sqlite3 via Terminal to audit TCC permission state — consider contextual baselining by user account and time-of-day
- Third-party privacy management tools (e.g., Privacy Cleaner, TCC permission managers from the App Store) that query and display TCC permissions to end users
- Automated build and CI systems using macOS agents where test harnesses reset application permissions between test runs using sqlite3 commands
Other platforms for T1548.006
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Read TCC Database Contents
Expected signal: macOS Unified Log: sqlite3 accessing TCC.db. tccd may log the access attempt.
- Test 2Attempt Direct TCC Database Modification
Expected signal: macOS Unified Log: sqlite3 attempting write to TCC.db. tccd may log unauthorized modification attempt. On protected systems, operation will fail.
- Test 3Check TCC Reset and Privacy Permissions
Expected signal: tccutil command execution. sqlite3 read access to TCC.db.
Unlock Pro Content
Get the full detection package for T1548.006 including response playbook, investigation guide, and atomic red team tests.