T1548.006 — TCC Manipulation

Tactic: Privilege Escalation · Platforms: macOS

Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to grant malicious executables elevated permissions. TCC is a Privacy & Security macOS control mechanism used to determine if the running process has permission to access the data or services…

Sub-technique of Abuse Elevation Control Mechanism (T1548).

Sigma detection rules (1)

T1548.006 Abuse Elevation Control Mechanism: TCC Manipulation

title: "T1548.006 Abuse Elevation Control Mechanism: TCC Manipulation"
id: a75458c6-37fc-4290-bade-6e60dcc8c8d1
description: 'TCC Database Manipulation via Launchctl and Unprotected SIP. (Retargeted to the file_change macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ParentProcessName, TCCModificationPath, TimeWindow, SIPStateCheckInterval.'
references:
  - https://attack.mitre.org/techniques/T1548/006
author: Shahrukh Khan
date: 2026-01-08
license: MIT
tags:
  - attack.privilege-escalation
  - attack.t1548.006

logsource:
  category: file_change
  product: macos

detection:
  selection:
    TargetFilename|contains: '/Library/Application Support/com.apple.TCC/TCC.db'
  condition: selection

falsepositives:
  - Only the tccd process and Full Disk Access grants through System Settings should ever modify TCC.db, so any other process writing to this file, or a direct sqlite3 write bypassing tccd, has very few legitimate sources and should be treated as high confidence.

level: critical

Related sub-techniques

Explore