Apple adds TCC events to Endpoint Security

macOS 15.4 will let Endpoint Security clients see TCC permission grants/revocations, giving defenders new visibility into how malware abuses user consent prompts.

This is a technical deep-dive from Objective-See on a new Endpoint Security (ES) event, ES_EVENT_TYPE_NOTIFY_TCC_MODIFY, arriving in macOS 15.4. TCC (Transparency, Consent and Control) governs access to sensitive resources like the microphone, camera, screen, and files, and most macOS malware doesn't bypass it via exploits but simply relies on the user clicking 'Allow.' Historically, security tools had no reliable API-level way to observe TCC changes and had to scrape fragile private log messages (as done by the Kronos tool). The new ES event finally exposes TCC grant/revoke/modify actions—including the service, identity, instigating process, and the reason for the change—directly to Endpoint Security clients.

The article walks through the es_event_tcc_modify_t structure and demonstrates it against both legitimate software (TextEdit, KnockKnock) and known macOS malware samples (ColdRoot, which directly patched the TCC database on older macOS; XCSSET, which used a zero-day to bypass TCC; WindTape, which invokes screencapture and is blocked by TCC; and JokerSpy's xcc tool, which actively probes TCC state). Testing reveals real limitations: the new event does not clearly attribute checks to the actual malicious binary (e.g., JokerSpy's xcc is invisible behind Terminal.app), entitlement-based TCC access isn't reported, and outright denials without a prompt (as with WindTape) generate no ES event at all.

Overall this is a defensive-tooling and research piece rather than an active-threat report. It provides no new indicators or exploited vulnerabilities, but is valuable to blue teams and macOS EDR vendors evaluating how to leverage the upcoming ES telemetry, and highlights gaps Apple may need to address before general release.

Source reporting: https://objective-see.org/blog/blog_0x7F.html