Elastic Defend high stable eql

User TCC DB Access by Unsigned or Untrusted Process

Detects the attempt to access or open the users TCC database by an unsigned or untrusted binary. This activity may indicate the presence of a malicious payload attempting to bypass TCC or gain awareness of system permissions in place.

View Source

Detection Logic

file where event.action == "open" and process.executable != null and 
 file.path like~ "/Users/*/Library/Application Support/com.apple.TCC/TCC.db" and
 (process.code_signature.trusted == false or process.code_signature.exists == false) and
 not Effective_process.executable in ("/Applications/Vorta.app/Contents/MacOS/vorta-darwin",
                                      "/Applications/CleanMyMac X.app/Contents/MacOS/CleanMyMac X",
                                      "/Applications/CleanMyMac X.app/Contents/Library/LoginItems/CleanMyMac X HealthMonitor.app/Contents/MacOS/CleanMyMac X HealthMonitor") and
 not process.code_signature.signing_id like~ "rg-*"

Field Validations

Loading…

Comments (0)

Loading comments...