Techniques › T1548.006 › AN1474
AN1474 Analytic 1474
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Unauthorized modification of TCC.db followed by elevated process execution under a trusted parent (e.g., Finder, SystemUIServer) or via launchctl environment override. Also includes identification of SIP being disabled, which is highly uncommon and a prerequisite for this abuse path.</p>
- Detects
- T1548.006 TCC Manipulation
- Part of
- DET0534 TCC Database Manipulation via Launchctl and Unprotected SIP
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | Execution of binaries with TCC protected access under unexpected parent processes such as Finder.app, SystemUIServer, or nsurlsessiond | DC0032 Process Creation |
| macos:unifiedlog | Modification or replacement of /Library/Application Support/com.apple.TCC/TCC.db or ~/Library/Application Support/com.apple.TCC/TCC.db | DC0061 File Modification |
| macos:unifiedlog | Execution of launchctl with setenv or bootout targeting TCC.db or AppleScript under Finder context | DC0064 Command Execution |
| macos:unifiedlog | System Integrity Protection (SIP) state reported as disabled | DC0018 Host Status |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ParentProcessName | May vary across macOS versions and user contexts; defenders can tune for known benign cases. |
TCCModificationPath | Custom user paths or redirected SQLite DBs may require alternate matching logic. |
TimeWindow | Temporal proximity between launchctl setenv and subsequent privileged access can be tuned. |
SIPStateCheckInterval | Frequency of SIP integrity checks may vary based on system hardening policies. |