Abuse Elevation Control Mechanism: TCC Manipulation T1548.006

Tactic: Privilege Escalation

Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to grant malicious executables elevated permissions. TCC is a Privacy & Security macOS control mechanism used to determine if the running process has permission to access the data or services protected by TCC, such as screen sharing, camera, microphone, or Full Disk Access (FDA).

Events covered

2 catalog events are tagged with this technique by at least one rule.

ProviderEventTitle
ESFexecProcess Execution
ESFopenFile Open

Authoring guide

These 7 rules share fields, values, and exclusions.

Fields filtered most (19 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
process_name5eq 3, starts_with 2, in 1osascript, bash, node, scp, sqlite
EventType4eq 4open, exec, tcc_modify
TargetFilename3wildcard 2, eq 1/library/preferences/com.apple.timemachine.plist, /users/*/*/library/*, /users/*/library/application support/com.apple.tcc/tcc.db
event.type3eq 2, in 1start, process_started
host.os.type3eq 3
process.args3eq 2, wildcard 1/*/Application Support/com.apple.TCC/TCC.db, reset, stricthostkeychecking=no
Image2is_not_null 2
parent_process_name2eq 1, wildcard 1Python*, Terminal, bash, osascript
process.parent.code_signature.exists2eq 2false
process.parent.code_signature.trusted2eq 2false
CommandLine1wildcard 1*scp *127.0.0.?:/*, *scp *localhost:/*
Effective_process.name1regex_match 1(bash|zsh|sh|osascript|python.*|perl.*|ruby.*|node|Termin...
Esql.unique_folders1ge 12
Tcc.right1eq 1allowed
Tcc.service1in 1systempolicydesktopfolder, systempolicydocumentsfolder, systempolicydownloadsfolder

Top indicator values (45 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
EventTypeeq
open
252
EventTypeeq
exec
1579
EventTypeeq
tcc_modify
12
event.typeeq
start
21087
process.parent.code_signature.existseq
false
225
process.parent.code_signature.trustedeq
false
226
CommandLinewildcard
*scp *127.0.0.?:/*
12
CommandLinewildcard
*scp *localhost:/*
12
Effective_process.nameregex_match
(bash|zsh|sh|osascript|python.*|perl.*|ruby.*|node|Terminal|iTerm2|ghostty)
1
Esql.unique_foldersge
2
1
TargetFilenameeq
/library/preferences/com.apple.timemachine.plist
1
TargetFilenamewildcard
/users/*/*/library/*
1
TargetFilenamewildcard
/users/*/library/application support/com.apple.tcc/tcc.db
12
Tcc.righteq
allowed
1
Tcc.servicein
systempolicydesktopfolder
1
Tcc.servicein
systempolicydocumentsfolder
1
Tcc.servicein
systempolicydownloadsfolder
1
Tcc.update_typeeq
create
1
event.typein
process_started
139
event.typein
start
141
file.nameeq
tcc.db
1
parent_process_nameeq
osascript
111
parent_process_namewildcard
Python*
13
parent_process_namewildcard
Terminal
13
parent_process_namewildcard
bash
115
parent_process_namewildcard
osascript
112
parent_process_namewildcard
sh
115
parent_process_namewildcard
zsh
115
process.argseq
reset
1
process.argseq
stricthostkeychecking=no
12

Exclusions (23 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
CommandLinewildcard
*vagrant@*127.0.0.1*
1
EventTypeeq
modification
1
EventTypein
deletion
1
EventTypein
open
1
Imagewildcard
/applications/*/ios.simruntime/*/system/library/privateframeworks/tcc.framework/tccd
1
Imagewildcard
/applications/forticlient.app/contents/frameworks/forticlient helper...
1
Imagewildcard
/applications/forticlient.app/contents/macos/forticlient
1
Imagewildcard
/applications/mosylesecurity.app/contents/macos/mosylesecurity
1
Imagewildcard
/applications/xcode*.app/contents/developer/platforms/iphoneos.platform/libra...
1
Imagewildcard
/library/developer/coresimulator/*
1
Imagewildcard
/sbin/launchd
1
Imagewildcard
/system/library/frameworks/fileprovider.framework/xpcservices/archiveservice....
1
Imagewildcard
/system/library/privateframeworks/systemmigration.framework/versions/a/resour...
1
Imagewildcard
/system/library/privateframeworks/tcc.framework/*
1
Imagewildcard
/users/*/downloads/xcode*.app/contents/developer/platforms/iphoneos.platform/...
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: macOS

Domain: Endpoint

Elastic 7 rules