Detect TCC Manipulation in Splunk
Adversaries manipulate or abuse macOS Transparency, Consent, and Control (TCC) to grant malicious processes elevated permissions without user consent. TCC controls access to camera, microphone, Full Disk Access, Screen Recording, and other sensitive resources. Techniques include: directly modifying the TCC SQLite database, injecting into existing processes that already have TCC entitlements, exploiting the limited process list to find TCC-entitled processes to hijack, or abusing MDM configuration profiles. Phil Stokes documented multiple TCC bypass techniques used by macOS malware.
MITRE ATT&CK
- Technique
- T1548 Abuse Elevation Control Mechanism
- Sub-technique
- T1548.006 TCC Manipulation
- Canonical reference
- https://attack.mitre.org/techniques/T1548/006/
SPL Detection Query
index=mac_logs (sourcetype="macos:unified_log" OR sourcetype="macos:syslog" OR sourcetype="syslog")
| eval detection_type=case(
match(_raw, "(?i)(TCC\.db|com\.apple\.TCC)") AND
match(_raw, "(?i)(write|modify|open|sqlite)") AND
NOT match(_raw, "(?i)(tccd|syspolicyd|mdmclient)"),
"TCC_DB_Unauthorized_Access",
match(_raw, "(?i)sqlite3") AND match(_raw, "(?i)(TCC\.db|kTCCService)"),
"TCC_SQLite_Access",
match(_raw, "(?i)(tccd|TCC)") AND
match(_raw, "(?i)(kTCCServiceFullDiskAccess|kTCCServiceScreenCapture|kTCCServiceCamera)") AND
NOT match(_raw, "(?i)(allowed|deny|user_approved)"),
"TCC_Service_Modification",
true(), null()
)
| where isnotnull(detection_type)
| table _time, host, user, detection_type, _raw
| sort - _timeDetects TCC manipulation via macOS unified log and syslog. TCC database access by non-authorized processes, sqlite3 commands targeting TCC.db, and TCC service modification events indicate potential bypass or abuse of macOS privacy controls.
Data Sources
Required Sourcetypes
False Positives & Tuning
- System updates legitimately migrating TCC database
- MDM profile deployments modifying TCC entries via mdmclient
- Privacy Reset operations during macOS upgrades
Other platforms for T1548.006
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Read TCC Database Contents
Expected signal: macOS Unified Log: sqlite3 accessing TCC.db. tccd may log the access attempt.
- Test 2Attempt Direct TCC Database Modification
Expected signal: macOS Unified Log: sqlite3 attempting write to TCC.db. tccd may log unauthorized modification attempt. On protected systems, operation will fail.
- Test 3Check TCC Reset and Privacy Permissions
Expected signal: tccutil command execution. sqlite3 read access to TCC.db.
Unlock Pro Content
Get the full detection package for T1548.006 including response playbook, investigation guide, and atomic red team tests.