T1548.006 TCC Manipulation

> Sub-technique of: T1548

High-Level Description

Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to grant malicious executables elevated permissions. TCC is a Privacy & Security macOS control mechanism used to determine if the running process has permission to access the data or services protected by TCC, such as screen sharing, camera, microphone, or Full Disk Access (FDA).

When an application requests to access data or a service protected by TCC, the TCC daemon (tccd) checks the TCC database, located at /Library/Application Support/com.apple.TCC/TCC.db (and ~/ equivalent), and an overwrites file (if connected to an MDM) for existing permissions. If permissions do not exist, then the user is prompted to grant permission. Once permissions are granted, the database stores the application's permissions and will not prompt the user again unless reset. For example, when a web browser requests permissions to the user's webcam, once granted the web browser may not explicitly prompt the user again.

Adversaries may access restricted data or services protected by TCC through abusing applications previously granted permissions through Process Injection or executing a malicious binary using another application. For example, adversaries can use Finder, a macOS native app with FDA permissions, to execute a malicious AppleScript. When executing under the Finder App, the malicious AppleScript inherits access to all files on the system without requiring a user prompt. When System Integrity Protection (SIP) is disabled, TCC protections are also disabled. For a system without SIP enabled, adversaries can manipulate the TCC database to add permissions to their malicious executable through loading an adversary controlled TCC database using environment variables and Launchctl.

Kill Chain Phase

• Defense Evasion (TA0005)
• Privilege Escalation (TA0004)

Platforms: macOS

What to Check

• ] Identify if TCC Manipulation technique is applicable to target environment
• ] Check macOS systems for indicators of TCC Manipulation
• ] Verify mitigations are bypassed or absent (3 known mitigations)
• ] Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to TCC Manipulation by examining the target platforms (macOS).

1. Assess Existing Defenses: Review whether mitigations for T1548.006 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

1. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1026 Privileged Account Management

Remove unnecessary users from the local administrator group on systems.

M1047 Audit

Routinely check applications using Automation under Security & Privacy System Preferences. To reset permissions, user's can utilize the tccutil reset command. When using Mobile Device Management (MDM), review the list of enabled or disabled applications in the MDMOverrides.plist which overrides the TCC database.

M1022 Restrict File and Directory Permissions

When using an MDM, ensure the permissions granted are specific to the requirements of the binary. Full Disk Access should be restricted to only necessary binaries in alignment with policy.

Detection

TCC Database Manipulation via Launchctl and Unprotected SIP

Risk Assessment

| Finding | Severity | Impact | | ------------------------------------- | -------- | --------------- | | TCC Manipulation technique applicable | High | Defense Evasion |

CWE Categories

| CWE ID | Title | | ------- | ---------------------------- | | CWE-693 | Protection Mechanism Failure |

References

• welivesecurity TCC
• TCC Database
• TCC macOS bypass
• Atomic Red Team - T1548.006
• MITRE ATT&CK - T1548.006