Detection rules › Sigma
macOS ULS Potential TCC Bypass Indicators
Detect logs referencing TCC errors or denials that might indicate attempts to bypass privacy controls.
Known false positives
- noisy applications frequently requesting sensitive entitlements
Rule body
title: macOS ULS Potential TCC Bypass Indicators
id: d5a8a3c7-58a6-4a8a-9e07-4ad7a0e6ec0a
status: experimental
description: Detect logs referencing TCC errors or denials that might indicate attempts
to bypass privacy controls.
author: Eric Brown - Nebulock, Inc.
date: 2025-10-29
logsource:
product: macos
service: unifiedlog
level: medium
detection:
selection:
message|contains:
- TCC
- kTCCService
- access denied
- prompting for access
condition: selection
falsepositives:
- noisy applications frequently requesting sensitive entitlements
modified: 2025/01/15
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
message|contains:
- TCC
- kTCCService
- access denied
- prompting for access
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
message | match |
| field:"message" kind:match |