Modification of macOS TCC Database

Shadows VMB@Vemorian_Mort

•updated Aug 13, 2026•2•0•12

Detects modifications to the Transparency, Consent, and Control (TCC) database on macOS. The rule categorizes activity based on the file path (system-wide or user-specific) and the user account performing the modification, identifying potentially unauthorized changes to application privacy permissions.