Potential Privilege Escalation via TCC bypass with fake TCC.db

file where file.name : "TCC.db" and 
process.executable != null and not
event.action in ("open", "deletion") and
not process.code_signature.team_id == "UBF8T346G9" and
not process.executable like~ (
  "/Applications/Xcode*.app/Contents/Developer/Platforms/iPhoneOS.platform/Library/Developer/CoreSimulator/Profiles/Runtimes/iOS.simruntime/Contents/Resources/RuntimeRoot/System/Library/PrivateFrameworks/TCC.framework/Support/tccd",
  "/System/Library/PrivateFrameworks/TCC.framework/*",
  "/usr/bin/sysdiagnose",
  "/Applications/FortiClient.app/Contents/MacOS/FortiClient",
  "/Applications/MosyleSecurity.app/Contents/MacOS/MosyleSecurity",
  "/Applications/*/iOS.simruntime/*/System/Library/PrivateFrameworks/TCC.framework/tccd",
  "/Users/*/Downloads/Xcode*.app/Contents/Developer/Platforms/iPhoneOS.platform/Library/Developer/CoreSimulator/Profiles/Runtimes/iOS.simruntime/Contents/Resources/RuntimeRoot/System/Library/PrivateFrameworks/TCC.framework/tccd",
  "/Library/Developer/CoreSimulator/*",
  "/System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService",
  "/System/Library/PrivateFrameworks/SystemMigration.framework/Versions/A/Resources/systemmigrationd",
  "/Applications/FortiClient.app/Contents/Frameworks/FortiClient Helper (Renderer).app/Contents/MacOS/FortiClient Helper (Renderer)",
  "/usr/libexec/xpcproxy", "/sbin/launchd") and 
not file.path like "/Volumes/*" and
not (event.action == "modification" and file.path like "/Users/*/Library/Application Support/com.apple.TCC/TCC.db" and not file.path like "/Users/*/*/Library/*") and
not file.path like
                ("/Users/*/Library/Developer/CoreSimulator/Devices/*/data/Library/TCC/TCC.db",
                 "/Users/*/Library/Developer/Xcode/UserData/Previews/Simulator Devices/*/data/Library/TCC/TCC.db",
                 "/private/var/folders/*/com.apple.desktopservices.ArchiveService/TemporaryItems/NSIRD_ArchiveService_*/logs/Accessibility/TCC.db")