[New Rule] Potential MacOS TCC Privacy Controls Bypass

[Samirbous]

Description

Identifies the use of sqlite3 to directly modify TCC SQLite database, this may indicate attempts to bypass MacOS privacy controls such as access sensitive resources like system camera, microphone, address book and calendar.

Required Info

• Eventing Sources:

• Target Operating Systems:

• Platforms

• Target ECS Version: x.x.x
• New fields required in ECS for this?
• Related issues or PRs

Optional Info

• References:

Example Data