Elastic Defend high stable eql

Suspicious Stop of TCCD via Launchctl

Detects the abnormal stop of the TCC daemon via the launchctl system binary. This activity can indicate an attempt to restart the TCC daemon following an exploit and may indicate a threat actors attempt to bypass security controls, escalate privileges, evade defenses.

View Source

Detection Logic

process where event.type == "start" and 
    (
        (
            process.name == "launchctl" and
            process.args like~ "stop" and
            process.args like~ "com.apple.tccd"
        ) or 
        (
            (process.name in ("sh", "zsh", "bash", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and
            process.args == "-c" and
            process.args like~ "*com.apple.tccd"
        )
    ) and not 
process.parent.executable in ("/sbin/launchd",
                              "/usr/local/jamf/bin/jamf", 
                              "/usr/bin/sudo") and not 
process.Ext.effective_parent.executable in ("/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal",
                                            "/usr/local/jamf/bin/jamf", 
                                            "/Applications/iTerm.app/Contents/MacOS/iTerm2")

Field Validations

Loading…

Comments (0)

Loading comments...