TCC Manipulation
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
T1548.006 is macOS-only and its single analytic AN1474 offers exactly one Sigma logsource, repeated four times: {product: macos, service: unifiedlog}. That logsource has no field vocabulary anywhere: the brief gives prose notes and no field names (all four logSources carry empty eventIds and notes such as 'Modification or replacement of /Library/Application Support/com.apple.TCC/TCC.db' and 'System Integrity Protection (SIP) state reported as disabled'); a grep for 'macos' or 'unifiedlog' across the non-test files of lib/sigma returns nothing, so there is no mapping to key on; and Sigma's own taxonomy models macOS process events as {category: process_creation, product: macos} with Image/CommandLine/ParentImage rather than as a unifiedlog service. […]
What the technique is
Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to grant malicious executables elevated permissions. TCC is a Privacy & Security macOS control mechanism used to determine if the running process has permission to access the data or services protected by TCC, such as screen sharing, camera, microphone, or Full Disk Access (FDA). When an application requests to access data or a service protected by TCC, the TCC daemon (tccd) checks the TCC database, located at /Library/Application Support/com.apple.TCC/TCC.db (and ~/ equivalent), and an overwrites file (if connected to an MDM) for existing permissions. If permissions do not exist, then the user is prompted to grant permission. Once permissions are granted, the database stores the application's permissions and will not prompt the user again unless reset. For example, when a web browser requests permissions to the user's webcam, once granted the web browser may not explicitly prompt the user again. Adversaries may access restricted data or services protected by TCC through abusing applications previously granted permissions through Process Injection or executing a malicious binary using another application. For example, adversaries can use Finder, a macOS native app with FDA permissions, to execute a malicious AppleScript. […]
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1474
Unauthorized modification of TCC.db followed by elevated process execution under a trusted parent (e.g., Finder, SystemUIServer) or via launchctl environment override. Also includes identification of SIP being disabled, which is highly uncommon and a prerequisite for this abuse path.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.