Elastic Defend high stable eql

Tccutil Reset via Suspicious Binary

Detects when Tccutils is used to reset the TCC database decisions for a specific service via a suspicious binary.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and process.name == "tccutil" and 
 process.args like~ "reset" and 
 (process.parent.name == "osascript" or (process.parent.code_signature.exists == false or process.parent.code_signature.trusted == false))

Field Validations

Loading…

Comments (0)

Loading comments...