Suspicious TCC Access Granted for User Folders

ELASTIC detection rule by Elastic · Elastic License v2

Detects when TCC access is granted for multiple user folders like Desktop, Downloads and Documents in quick succession. Many information stealers require TCC permissions to access these locations and will prompt users to grant access for data exfiltration.

[metadata]
creation_date = "2026/01/30"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
Detects when TCC access is granted for multiple user folders like Desktop, Downloads and Documents 
in quick succession. Many information stealers require TCC permissions to access these locations and 
will prompt users to grant access for data exfiltration.
"""
from = "now-9m"
language = "esql"
license = "Elastic License v2"
name = "Suspicious TCC Access Granted for User Folders"
risk_score = 73
rule_id = "ffd8b5e9-aa63-42b3-aead-6fdb170da9a3"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Tactic: Collection",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide"
]
type = "esql"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Suspicious TCC Access Granted for User Folders

The Transparency, Consent, and Control (TCC) framework is macOS's privacy protection mechanism that controls application access to sensitive resources like the Desktop, Documents, and Downloads folders. Threat actors may manipulate the TCC database to grant unauthorized access to these protected locations, enabling data theft without triggering user consent prompts. This detection rule identifies when scripting interpreters or command-line tools create multiple TCC permission grants in rapid succession, indicating potential automated TCC manipulation.

### Possible investigation steps

- Review the Effective_process.name and Effective_process.executable fields to identify which process is creating TCC permission grants and assess whether this is expected behavior.
- Examine the Tcc.service values to understand which protected folders (Desktop, Documents, Downloads) were granted access and evaluate the sensitivity of data in those locations.
- Investigate the Effective_process.parent.executable and command_line to trace how the TCC-modifying process was launched and identify the initial execution vector.
- Review the timing and count of TCC grants to determine if this is an automated batch operation characteristic of malicious activity.
- Check the TCC.db database directly using sqlite3 to review all permission grants and identify any unauthorized entries.
- Correlate with file access events to determine if the granted permissions were subsequently used to access sensitive data.
- Review the user.name associated with the activity and verify whether they would have legitimate reasons to grant these permissions.

### False positive analysis

- Legitimate applications during first launch or installation may request TCC access, but typically through standard user prompts rather than direct database modification. Verify if application installation was expected.
- Enterprise MDM solutions may configure TCC permissions during device setup or policy enforcement. Confirm with IT operations if MDM deployments were scheduled.
- Automation and scripting workflows may require TCC access for legitimate file operations. Review with the script owner to confirm legitimacy.
- System administration tasks may involve TCC manipulation for specific operational requirements. Verify with IT staff before dismissing.

### Response and remediation

- Immediately revoke the unauthorized TCC access grants by removing the malicious entries from the TCC.db database or resetting TCC permissions for the affected application.
- Terminate the suspicious process that created the TCC grants and prevent it from restarting.
- Isolate the affected macOS system to prevent potential data exfiltration using the newly granted permissions.
- Conduct a forensic review of file access events to determine if sensitive data was accessed using the unauthorized TCC permissions.
- Scan the system for additional malware, persistence mechanisms, or indicators of compromise.
- Reset TCC permissions to their default state using tccutil reset or by deleting and recreating the TCC.db database.
- Review other systems in the environment for similar TCC manipulation activity.
- Escalate to the incident response team for comprehensive investigation if data theft is suspected.
"""
query = '''
FROM logs-endpoint.events.*
| WHERE host.os.type == "macos" 
    AND event.action == "tcc_modify" 
    AND Tcc.right == "allowed"
    AND Tcc.update_type == "create"
    AND Tcc.service IN ("SystemPolicyDocumentsFolder", "SystemPolicyDownloadsFolder", "SystemPolicyDesktopFolder")
    AND Effective_process.name RLIKE "(bash|zsh|sh|osascript|python.*|perl.*|ruby.*|node|Terminal|iTerm2|ghostty)"
| STATS 
    Esql.grant_count = COUNT(*),
    Esql.unique_folders = COUNT_DISTINCT(Tcc.service),  
    Esql.folders = VALUES(Tcc.service)
  BY Effective_process.entity_id, Effective_process.executable, host.name, user.name
| WHERE Esql.unique_folders >= 2
| KEEP Esql.*, Effective_process.entity_id, Effective_process.executable, host.name, user.name
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"

[[rule.threat.technique.subtechnique]]
id = "T1548.006"
name = "TCC Manipulation"
reference = "https://attack.mitre.org/techniques/T1548/006/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1005"
name = "Data from Local System"
reference = "https://attack.mitre.org/techniques/T1005/"

[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"

[[rule.threat.technique.subtechnique]]
id = "T1548.006"
name = "TCC Manipulation"
reference = "https://attack.mitre.org/techniques/T1548/006/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

e558b162-9630-4cce-b1a2-3132f9e1b527

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion