tfMITRE ATT&CK sub-technique

TCC Manipulation T1548.006

sub-technique of T1548 Abuse Elevation Control Mechanism

Tactic: Privilege Escalation
Platform: macOS
Version: 2.0
Created: 21 March 2024
Last modified: 12 May 2026
Contributors: Marina Liang; Wojciech Reguła @_r3ggi; Csaba Fitzl @theevilbit of Kandji

Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to grant malicious executables elevated permissions. TCC is a Privacy & Security macOS control mechanism used to determine if the running process has permission to access the data or services protected by TCC, such as screen sharing, camera, microphone, or Full Disk Access (FDA).

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

TCC Manipulation MITRE reference T1548.006

44th pctamong all ATT&CK techniques for number of tools

1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

XCSSETS0658 ↗

For several modules, XCSSET attempts to access or list the contents of user folders such as Desktop, Downloads, and Documents. If the folder does not exist or access is denied, it enters a loop where it resets the TCC database and retries access.1

created 2021-10-05MALWARE

All 1 software entries for this technique

Offense vs defense T1548.006

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

TCC Manipulation detection strategy DET0534

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

TCC Database Manipulation via Launchctl and Unprotected SIP

Enterprise

1 platform

AN1474 · macOS

Unauthorized modification of TCC.db followed by elevated process execution under a trusted parent (e.g., Finder, SystemUIServer) or via launchctl environment override. Also includes identification of SIP being disabled, which is highly uncommon and a prerequisite for this abuse path.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	macos:unifiedlog	System Integrity Protection (SIP) state reported as disabled
Process CreationDC0032	macos:unifiedlog	Execution of binaries with TCC protected access under unexpected parent processes such as Finder.app, SystemUIServer, or nsurlsessiond
File ModificationDC0061	macos:unifiedlog	Modification or replacement of /Library/Application Support/com.apple.TCC/TCC.db or ~/Library/Application Support/com.apple.TCC/TCC.db
Command ExecutionDC0064	macos:unifiedlog	Execution of launchctl with setenv or bootout targeting TCC.db or AppleScript under Finder context

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcessName	May vary across macOS versions and user contexts; defenders can tune for known benign cases.
TCCModificationPath	Custom user paths or redirected SQLite DBs may require alternate matching logic.
TimeWindow	Temporal proximity between launchctl setenv and subsequent privileged access can be tuned.
SIPStateCheckInterval	Frequency of SIP integrity checks may vary based on system hardening policies.

AuditM1047

Routinely check applications using Automation under Security & Privacy System Preferences. To reset permissions, user's can utilize the tccutil reset command. When using Mobile Device Management (MDM), review the list of enabled or disabled applications in the MDMOverrides.plist which overrides the TCC database.

Privileged Account ManagementM1026

Remove unnecessary users from the local administrator group on systems.

Restrict File and Directory PermissionsM1022

When using an MDM, ensure the permissions granted are specific to the requirements of the binary. Full Disk Access should be restricted to only necessary binaries in alignment with policy.

TCC Manipulation detections T1548.006

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs