Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for T1548.006.
Upgrade to ProDetect TCC Manipulation in Microsoft Sentinel
This detection identifies adversary attempts to manipulate macOS Transparency, Consent, and Control (TCC) protections — either by directly modifying the TCC SQLite database to grant unauthorized permissions, by injecting into TCC-privileged applications such as Finder to inherit Full Disk Access, by abusing environment variables to load a rogue TCC database, or by exploiting SIP-disabled systems where TCC protections are bypassed entirely. Successful TCC abuse grants attackers access to protected resources including the camera, microphone, screen recording, Full Disk Access, and sensitive user directories without user prompts.
MITRE ATT&CK
- Technique
- T1548 Abuse Elevation Control Mechanism
- Sub-technique
- T1548.006 TCC Manipulation
- Canonical reference
- https://attack.mitre.org/techniques/T1548/006/
KQL Detection Query
let TCCDbPaths = dynamic(["/Library/Application Support/com.apple.TCC/TCC.db", "/private/var/"]);
let SuspiciousParents = dynamic(["bash", "sh", "zsh", "python3", "python", "ruby", "perl", "osascript", "curl", "wget"]);
union
(
DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath has "/com.apple.TCC" or FileName == "TCC.db"
| where ActionType in ("FileModified", "FileCreated", "FileRenamed")
| where InitiatingProcessFileName !in ("tccd", "syspolicyd", "mdmclient", "com.apple.ManagedClient")
| project Timestamp, DeviceName, ActionType, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| extend DetectionType = "TCC DB Direct Modification"
),
(
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (ProcessCommandLine has "TCC.db" and ProcessCommandLine has_any ("sqlite3", "INSERT INTO access", "UPDATE access"))
or (ProcessCommandLine has "HOME_TCC_DB" or ProcessCommandLine has "SQLITE_TMPDIR")
or (FileName == "sqlite3" and ProcessCommandLine has "/com.apple.TCC/")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| extend DetectionType = "TCC DB SQLite Manipulation"
),
(
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ("Finder", "finder")
| where FileName in~ ("osascript", "bash", "sh", "zsh", "python3", "python", "ruby", "perl")
| where ProcessCommandLine !has "Finder.app/Contents/Resources"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| extend DetectionType = "Finder TCC Inheritance Abuse"
)
| summarize count() by Timestamp, DeviceName, DetectionType, ProcessCommandLine, InitiatingProcessFileName, AccountName
| order by Timestamp descDetects TCC manipulation via three vectors: direct modification of TCC.db files by non-system processes, SQLite-based injection of permission entries into the TCC database, and abuse of Finder's Full Disk Access to spawn privileged child processes that inherit TCC permissions.
Data Sources
Required Tables
False Positives & Tuning
- MDM solutions (Jamf, Kandji, Mosyle) legitimately modify TCC.db via mdmclient or profiles when deploying privacy preference policy controls
- macOS system updates or security patches may invoke tccd and modify TCC databases during upgrade workflows
- Finder legitimately spawns osascript for Automator workflows and user-created Finder scripts that are intentionally privileged
Other platforms for T1548.006
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Direct SQLite Injection into System TCC Database
Expected signal: DeviceFileEvents with ActionType=FileModified on /Library/Application Support/com.apple.TCC/TCC.db, initiating process sqlite3. macOS Unified Log entries from com.apple.TCC subsystem recording database modification.
- Test 2Rogue TCC Database via Environment Variable
Expected signal: Process launch event for osascript with SQLITE_TMPDIR environment variable set to non-standard path. File creation events in /tmp/tcc_test/com.apple.TCC/. sqlite3 process execution with TCC.db path argument.
- Test 3Finder TCC Inheritance via AppleScript
Expected signal: Process launch event showing osascript spawned as child of Finder process. Subsequent shell command execution accessing ~/Library/Messages/ which is normally TCC-protected. File creation event at /tmp/tcc_finder_test.txt.
Unlock playbooks & atomic tests with Pro
Get the full detection package for T1548.006 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month