Suspicious Stop of TCCD via Launchctl

[rule]
description = """
Detects the abnormal stop of the TCC daemon via the launchctl system binary. This activity can indicate an attempt to
restart the TCC daemon following an exploit and may indicate a threat actors attempt to bypass security controls,
escalate privileges, evade defenses.
"""
id = "ffda6af2-fa65-4ef6-88a4-318b396844fe"
license = "Elastic License v2"
name = "Suspicious Stop of TCCD via Launchctl"
os_list = ["macos"]
version = "1.0.15"

query = '''
process where event.type == "start" and 
    (
        (
            process.name == "launchctl" and
            process.args like~ "stop" and
            process.args like~ "com.apple.tccd"
        ) or 
        (
            (process.name in ("sh", "zsh", "bash", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and
            process.args == "-c" and
            process.args like~ "*com.apple.tccd"
        )
    ) and not 
process.parent.executable in ("/sbin/launchd",
                              "/usr/local/jamf/bin/jamf", 
                              "/usr/bin/sudo") and not 
process.Ext.effective_parent.executable in ("/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal",
                                            "/usr/local/jamf/bin/jamf", 
                                            "/Applications/iTerm.app/Contents/MacOS/iTerm2")
'''

min_endpoint_version = "8.5.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1553"
name = "Subvert Trust Controls"
reference = "https://attack.mitre.org/techniques/T1553/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.5.0"