macOS Trusted Binary Requirement Extraction for TCC Bypass
Detects the 'codesign' utility being used to extract code-signing requirements from trusted macOS system binaries. This is a key step used by malware to forge TCC permissions and inherit the privileges of trusted applications. The rule specifically looks for 'codesign' execution with '-d' and '--requirements' flags targeting common trusted binaries, initiated by scripting interpreters.
Microsoft Sentinel (KQL)
