Detect TCC Manipulation in Microsoft Sentinel
Adversaries manipulate or abuse macOS Transparency, Consent, and Control (TCC) to grant malicious processes elevated permissions without user consent. TCC controls access to camera, microphone, Full Disk Access, Screen Recording, and other sensitive resources. Techniques include: directly modifying the TCC SQLite database, injecting into existing processes that already have TCC entitlements, exploiting the limited process list to find TCC-entitled processes to hijack, or abusing MDM configuration profiles. Phil Stokes documented multiple TCC bypass techniques used by macOS malware.
MITRE ATT&CK
- Technique
- T1548 Abuse Elevation Control Mechanism
- Sub-technique
- T1548.006 TCC Manipulation
- Canonical reference
- https://attack.mitre.org/techniques/T1548/006/
KQL Detection Query
// T1548.006 — TCC Database Manipulation detection (macOS)
// Requires macOS endpoints in Defender for Endpoint
// Part 1: Detect writes to TCC database files
let TCCDBWrite = DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName in~ ("TCC.db", "com.apple.TCC.db")
or FolderPath has_any ("/Library/Application Support/com.apple.TCC/",
"/Users/", "/private/var/")
and (FileName endswith ".db" and FolderPath has "TCC")
| where ActionType in ("FileModified", "FileCreated")
| where InitiatingProcessFileName !in~ ("tccd", "syspolicyd", "mdmclient",
"System Preferences", "SystemPreferences")
| extend DetectionType = "TCC_Database_Modified"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType;
// Part 2: Detect sqlite3 accessing TCC database
let TCCSQLite = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "sqlite3"
| where ProcessCommandLine has_any ("TCC.db", "com.apple.TCC", "kTCCService")
| extend DetectionType = "TCC_SQLite_Direct_Access"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType;
// Part 3: Detect process injection into TCC-privileged processes
let TCCProcessInject = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("Finder", "Terminal", "Preview",
"Safari", "Mail", "Calendar")
| where FileName in~ ("python", "python3", "perl", "ruby", "bash", "sh",
"osascript", "curl", "nc")
| where InitiatingProcessCommandLine !has ProcessCommandLine // Spawn not from parent's expected cmds
| extend DetectionType = "TCC_Privileged_Process_Spawn"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, DetectionType;
union TCCDBWrite, TCCSQLite, TCCProcessInject
| sort by Timestamp descThree-part macOS TCC manipulation detection. Part 1 detects direct writes to TCC.db (the SQLite database controlling app permissions) by non-system processes. Part 2 catches sqlite3 commands directly accessing TCC database files. Part 3 identifies TCC-privileged macOS applications (Finder, Terminal, Safari) spawning shells or scripts, indicating injection into a TCC-entitled process.
Data Sources
Required Tables
False Positives & Tuning
- System software updates that legitimately modify TCC database during migration
- MDM enrollment processes modifying TCC settings via configuration profiles
- tccd daemon (the TCC daemon) accessing its own database during normal operation
- Privacy Reset operations during macOS upgrade or system migration
Other platforms for T1548.006
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Read TCC Database Contents
Expected signal: macOS Unified Log: sqlite3 accessing TCC.db. tccd may log the access attempt.
- Test 2Attempt Direct TCC Database Modification
Expected signal: macOS Unified Log: sqlite3 attempting write to TCC.db. tccd may log unauthorized modification attempt. On protected systems, operation will fail.
- Test 3Check TCC Reset and Privacy Permissions
Expected signal: tccutil command execution. sqlite3 read access to TCC.db.
Unlock Pro Content
Get the full detection package for T1548.006 including response playbook, investigation guide, and atomic red team tests.