macOS TCC Database Modified via Remote SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to modify the macOS Transparency, Consent, and Control (TCC) database over an SSH connection. The TCC database stores user privacy settings, and its modification can indicate an attempt to bypass security controls or escalate privileges. The rule specifically looks for the string "TCC.db" within TCP traffic directed to port 22 (SSH).