AN1474
Analytic 1474
macOS
Unauthorized modification of TCC.db followed by elevated process execution under a trusted parent (e.g., Finder, SystemUIServer) or via launchctl environment override. Also includes identification of SIP being disabled, which is highly uncommon and a prerequisite for this abuse path.
macos:unifiedlog
Execution of binaries with TCC protected access under unexpected parent processes such as Finder.app, SystemUIServer, or nsurlsessiond
macos:unifiedlog
Modification or replacement of /Library/Application Support/com.apple.TCC/TCC.db or ~/Library/Application Support/com.apple.TCC/TCC.db
macos:unifiedlog
Execution of launchctl with setenv or bootout targeting TCC.db or AppleScript under Finder context
macos:unifiedlog
System Integrity Protection (SIP) state reported as disabled
[ParentProcessName]
May vary across macOS versions and user contexts; defenders can tune for known benign cases.
[TCCModificationPath]
Custom user paths or redirected SQLite DBs may require alternate matching logic.
[TimeWindow]
Temporal proximity between launchctl setenv and subsequent privileged access can be tuned.
[SIPStateCheckInterval]
Frequency of SIP integrity checks may vary based on system hardening policies.