macOS TCC.db | Artifact of the Day

This hidden database shows exactly what attackers accessed on your Mac.

Artifact of the Day | DFIR Media

• You find suspicious screen recording permissions granted to an unknown app.
• The answer lives in TCC dot DB, macOS's permission tracking database.
• It records every app granted access to camera, microphone, and screen recording.
• Attackers modify this database to grant themselves Full Disk Access without prompts.
• Query it with sqlite3 or use TCC Unplugged to spot unauthorized changes.
• A sudden Full Disk Access grant? That's your red flag for compromise.

AI-generated narration | DFIR Media

Видео macOS TCC.db | Artifact of the Day канала DFIR Lab