Apple adds TCC events to Endpoint Security

27 March 2025 elevated threat

macOS 15.4 will let Endpoint Security clients see TCC permission grants/revocations, giving defenders new visibility into how malware abuses user consent prompts.

This is a technical deep-dive from Objective-See on a new Endpoint Security (ES) event, ES_EVENT_TYPE_NOTIFY_TCC_MODIFY, arriving in macOS 15.4. TCC (Transparency, Consent and Control) governs access to sensitive resources like the microphone, camera, screen, and files, and most macOS malware doesn't bypass it via exploits but simply relies on the user clicking 'Allow.' Historically, security tools had no reliable API-level way to observe TCC changes and had to scrape fragile private log messages (as done by the Kronos tool). The new ES event finally exposes TCC grant/revoke/modify actions—including the service, identity, instigating process, and the reason for the change—directly to Endpoint Security clients.

The article walks through the es_event_tcc_modify_t structure and demonstrates it against both legitimate software (TextEdit, KnockKnock) and known macOS malware samples (ColdRoot, which directly patched the TCC database on older macOS; XCSSET, which used a zero-day to bypass TCC; WindTape, which invokes screencapture and is blocked by TCC; and JokerSpy's xcc tool, which actively probes TCC state). Testing reveals real limitations: the new event does not clearly attribute checks to the actual malicious binary (e.g., JokerSpy's xcc is invisible behind Terminal.app), entitlement-based TCC access isn't reported, and outright denials without a prompt (as with WindTape) generate no ES event at all.

Overall this is a defensive-tooling and research piece rather than an active-threat report. It provides no new indicators or exploited vulnerabilities, but is valuable to blue teams and macOS EDR vendors evaluating how to leverage the upcoming ES telemetry, and highlights gaps Apple may need to address before general release.

Mentioned in this report

Malware ColdrootJokerSpyWindTapeXCSSET

Detection guidance

Unauthorized Process Invoking Screen Capture with TCC Access

ATT&CK T1113

Process launching screencapture utility or similar screen-capture tools after TCC grant/check events, potentially following malicious TCC manipulation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unauthorized Process Invoking Screen Capture with TCC Access
description: Detects processes spawning screencapture or equivalent screen-capture
  utilities in conjunction with TCC permission checks or grants. Malware such as WindTape
  uses screencapture after manipulating or probing TCC state to capture user activity.
tags:
- attack.collection
- attack.t1113
logsource:
  category: process_creation
  product: macos
detection:
  selection_screencapture:
    Image|endswith:
    - /screencapture
    - /screencaptureui
    ParentImage|endswith:
    - /Terminal
    - /bash
    - /sh
    - /zsh
  selection_suspicious_parent:
    Image|endswith:
    - /screencapture
    ParentImage|contains:
    - /tmp
    - /var/tmp
    - /Library/Caches
  filter_legitimate_screenshot:
    CommandLine|contains:
    - -x
    - -P
  condition: (selection_screencapture or selection_suspicious_parent) and not filter_legitimate_screenshot
falsepositives:
- Legitimate screenshot utilities and screen recording software
- System administrators capturing screenshots for documentation
level: medium
id: 92f98109-8b97-5c66-97cb-49bde7d6bb23
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x7F.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free