Command-line tool for managing the Transparency, Consent, and Control (TCC) permissions database
tccutiltccutilSandbox: execFile · Timeout: 30s
security.defenseevasion.bypass Use the tccutil to reset specific permissions: Banshee Stealer resets the permissions that have already been allowed to applications on the system, which will cause the user to be prompted to give them again. This action may be intended to trick the user into unknowingly giving authorizations to the malware.
tccutil reset AppleEventsUse the tccutil to reset specific permissions for an application: Attackers use tccutil to reset permissions for services like Camera, Microphone, or AppleEvents.
tccutil reset AppleEvents com.apple.Terminal| Type | Rule / Indicator |
|---|---|
| other | No detections at time of publishing |
tccutil is a command-line tool for managing the Transparency, Consent, and Control (TCC) permissions database. It allows users to revoke permissions for applications to access certain system resources, such as the camera, microphone, and location.