detection.wiki

Detection rules › Sigma

macOS ULS TCC Access Denied

Status
experimental
Severity
medium
Log source
product macos, service unifiedlog
Author
Eric Brown - Nebulock, Inc.
Source
github.com/Nebulock-Inc/macos-coresigma

Detect tccd denials indicating apps denied access to protected categories.

Known false positives

  • chatty apps requesting protected resources frequently

Rule body

title: macOS ULS TCC Access Denied
id: 5b6d7e8f-1a2b-4c3d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detect tccd denials indicating apps denied access to protected categories.
author: Eric Brown - Nebulock, Inc.
date: 2025-10-29
logsource:
  product: macos
  service: unifiedlog
level: medium
detection:
  selection:
    subsystem: com.apple.TCC
    message|contains:
    - Denied
    - kTCCService
  condition: selection
falsepositives:
- chatty apps requesting protected resources frequently
modified: 2025/01/15

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  subsystem: com.apple.TCC
  message|contains:
  - Denied
  - kTCCService

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
messagematch
  • Denied
  • kTCCService
field:"message" kind:match
subsystemeq
  • com.apple.TCC
field:"subsystem" kind:eq value:"com.apple.TCC"