Detection rules › Sigma

macOS TCC Privacy Bypass Attempt

Status
experimental
Severity
high
Log source
product macos, service unifiedlog
Author
Eric Brown - Nebulock, Inc.
Source
github.com/Nebulock-Inc/macos-coresigma

Detects potential attempts to bypass macOS Transparency, Consent, and Control (TCC) privacy protections. TCC protects sensitive resources like Camera, Microphone, Screen Recording, and Full Disk Access.

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationT1548 Abuse Elevation Control Mechanism

Rule body yaml

title: macOS TCC Privacy Bypass Attempt
id: a1b2c3d4-e5f6-4789-abcd-ef0123456789
status: experimental
description: |
  Detects potential attempts to bypass macOS Transparency, Consent, and Control (TCC)
  privacy protections. TCC protects sensitive resources like Camera, Microphone, 
  Screen Recording, and Full Disk Access.
references:
  - https://attack.mitre.org/techniques/T1548/
  - https://developer.apple.com/documentation/security/tcc
  - https://objective-see.org/blog/blog_0x6C.html
author: Eric Brown - Nebulock, Inc.
date: 2025/01/22
modified: 2025/01/22
logsource:
  product: macos
  service: unifiedlog
detection:
  selection_subsystem:
    subsystem: com.apple.TCC
  selection_bypass_indicators:
    message|contains:
      - 'access denied'
      - 'Denied'
      - 'prompting for access'
      - 'kTCCServiceSystemPolicyAllFiles'
      - 'kTCCServiceScreenCapture'
      - 'kTCCServiceMicrophone'
      - 'kTCCServiceCamera'
      - 'kTCCServiceAccessibility'
      - 'kTCCServicePostEvent'
  filter_normal_prompts:
    message|contains:
      - 'User approved'
      - 'granted'
  condition: selection_subsystem and selection_bypass_indicators and not filter_normal_prompts
falsepositives:
  - Legitimate applications requesting sensitive permissions
  - First-time application launches requesting access
level: high
tags:
  - attack.privilege_escalation
  - attack.defense_evasion
  - attack.t1548

Stages and Predicates

Stage 0: condition

selection_subsystem and selection_bypass_indicators and not filter_normal_prompts

Stage 1: selection_subsystem

selection_subsystem:
  subsystem: com.apple.TCC

Stage 2: selection_bypass_indicators

selection_bypass_indicators:
  message|contains:
    - 'access denied'
    - 'Denied'
    - 'prompting for access'
    - 'kTCCServiceSystemPolicyAllFiles'
    - 'kTCCServiceScreenCapture'
    - 'kTCCServiceMicrophone'
    - 'kTCCServiceCamera'
    - 'kTCCServiceAccessibility'
    - 'kTCCServicePostEvent'

Stage 3: not filter_normal_prompts

filter_normal_prompts:
  message|contains:
    - 'User approved'
    - 'granted'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
messagematchUser approved
messagematchgranted

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
messagematch
  • Denied
  • access denied
  • kTCCServiceAccessibility
  • kTCCServiceCamera
  • kTCCServiceMicrophone
  • kTCCServicePostEvent
  • kTCCServiceScreenCapture
  • kTCCServiceSystemPolicyAllFiles
  • prompting for access
subsystemeq
  • com.apple.TCC