Apple adds TCC events to Endpoint Security
macOS 15.4 will let Endpoint Security clients see TCC permission grants/revocations, giving defenders new visibility into how malware abuses user consent prompts.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This is a technical deep-dive from Objective-See on a new Endpoint Security (ES) event, ES_EVENT_TYPE_NOTIFY_TCC_MODIFY, arriving in macOS 15.4. TCC (Transparency, Consent and Control) governs access to sensitive resources like the microphone, camera, screen, and files, and most macOS malware doesn't bypass it via exploits but simply relies on the user clicking 'Allow.' Historically, security tools had no reliable API-level way to observe TCC changes and had to scrape fragile private log messages (as done by the Kronos tool). The new ES event finally exposes TCC grant/revoke/modify actions—including the service, identity, instigating process, and the reason for the change—directly to Endpoint Security clients.
The article walks through the es_event_tcc_modify_t structure and demonstrates it against both legitimate software (TextEdit, KnockKnock) and known macOS malware samples (ColdRoot, which directly patched the TCC database on older macOS; XCSSET, which used a zero-day to bypass TCC; WindTape, which invokes screencapture and is blocked by TCC; and JokerSpy's xcc tool, which actively probes TCC state). Testing reveals real limitations: the new event does not clearly attribute checks to the actual malicious binary (e.g., JokerSpy's xcc is invisible behind Terminal.app), entitlement-based TCC access isn't reported, and outright denials without a prompt (as with WindTape) generate no ES event at all.
Overall this is a defensive-tooling and research piece rather than an active-threat report. It provides no new indicators or exploited vulnerabilities, but is valuable to blue teams and macOS EDR vendors evaluating how to leverage the upcoming ES telemetry, and highlights gaps Apple may need to address before general release.
Mentioned in this report
Detection guidance
Unauthorized Process Invoking Screen Capture with TCC Access
A behavioural hunt for the technique in general.
Process launching screencapture utility or similar screen-capture tools after TCC grant/check events, potentially following malicious TCC manipulation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthorized Process Invoking Screen Capture with TCC Access
description: Detects processes spawning screencapture or equivalent screen-capture
utilities in conjunction with TCC permission checks or grants. Malware such as WindTape
uses screencapture after manipulating or probing TCC state to capture user activity.
tags:
- attack.collection
- attack.t1113
logsource:
category: process_creation
product: macos
detection:
selection_screencapture:
Image|endswith:
- /screencapture
- /screencaptureui
ParentImage|endswith:
- /Terminal
- /bash
- /sh
- /zsh
selection_suspicious_parent:
Image|endswith:
- /screencapture
ParentImage|contains:
- /tmp
- /var/tmp
- /Library/Caches
filter_legitimate_screenshot:
CommandLine|contains:
- -x
- -P
condition: (selection_screencapture or selection_suspicious_parent) and not filter_legitimate_screenshot
falsepositives:
- Legitimate screenshot utilities and screen recording software
- System administrators capturing screenshots for documentation
level: medium
id: 92f98109-8b97-5c66-97cb-49bde7d6bb23
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x7F.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs