{"id":163267,"date":"2025-03-29T06:47:11","date_gmt":"2025-03-29T06:47:11","guid":{"rendered":"https:\/\/peraltafinancing.com\/apple-2\/michael-tsai-blog-macos-15-4-adds-tcc-events-to-endpoint-security\/"},"modified":"2025-03-29T06:47:11","modified_gmt":"2025-03-29T06:47:11","slug":"michael-tsai-blog-macos-15-4-adds-tcc-events-to-endpoint-security","status":"publish","type":"post","link":"https:\/\/fivemor.com\/?p=163267","title":{"rendered":"Michael Tsai &#8211; Blog &#8211; macOS 15.4 Adds TCC Events to Endpoint Security"},"content":{"rendered":"<p> <br \/>\n<\/p>\n<div>\n<p><a href=\"https:\/\/objective-see.org\/blog\/blog_0x7F.html\">Patrick Wardle<\/a> (<a href=\"https:\/\/x.com\/patrickwardle\/status\/1905363186305335321\">tweet<\/a>):<\/p>\n<blockquote cite=\"https:\/\/objective-see.org\/blog\/blog_0x7F.html\">\n<p>Since TCC is designed to protect these resources, it poses a challenge for malware that often tries to access them. Generally malware takes one of two approaches: exploiting TCC bugs, or obtaining explicit user permission access to the TCC protected item. The former is rather uncommon, while the latter is much more widespread as TCC can be trivially \u201ccircumvented\u201d if the user acquiesces (sometimes as simply as clicking \u2018Allow\u2019 on a single TCC alert).<\/p>\n<p>[\u2026]<\/p>\n<p>Since the majority of macOS malware circumvents TCC through explicit user approval, it would be incredibly helpful for any security tool to detect this \u2014 and possibly override the user\u2019s risky decision. Until now the best (only?) option was to ingest log messages generated by the TCC subsystem.<\/p>\n<p>[\u2026]<\/p>\n<p>In the macOS 15.4 SDK files, specifically <code>EndpointSecurity\/ESTypes.h<\/code> we find a brand new Endpoint Security event: <code>ES_EVENT_TYPE_NOTIFY_TCC_MODIFY<\/code>[\u2026]<\/p>\n<\/blockquote>\n<p>This sounds good for anti-malware software, but I still think we need basic APIs for apps to query, request, and reset the permissions they need.<\/p>\n<p>Previously:<\/p>\n<p class=\"tags\"><a rel=\"tag\" href=\"https:\/\/mjtsai.com\/blog\/tag\/endpoint-security\/\">Endpoint Security<\/a> <a rel=\"tag\" href=\"https:\/\/mjtsai.com\/blog\/tag\/mac\/\">Mac<\/a> <a rel=\"tag\" href=\"https:\/\/mjtsai.com\/blog\/tag\/macos-15-sequoia\/\">macOS 15 Sequoia<\/a> <a rel=\"tag\" href=\"https:\/\/mjtsai.com\/blog\/tag\/malware\/\">Malware<\/a> <a rel=\"tag\" href=\"https:\/\/mjtsai.com\/blog\/tag\/programming\/\">Programming<\/a> <a rel=\"tag\" href=\"https:\/\/mjtsai.com\/blog\/tag\/transparency-consent-and-control-tcc\/\">Transparency Consent and Control (TCC)<\/a><\/p>\n<h2><a id=\"respond\"><\/a><br \/>\nComments<br \/>\n <\/h2>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"<p>Patrick Wardle (tweet): Since TCC is designed to protect these resources, it poses a challenge for malware that often tries to access them. Generally malware takes one of two approaches: exploiting TCC bugs, or obtaining explicit user permission access to the TCC protected item. The former is rather uncommon, while the latter is much more [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11768],"tags":[12908,3767,37575,12573,16746,1823,2764,13958,17088],"dealstore":[],"offerexpiration":[],"class_list":["post-163267","post","type-post","status-publish","format-standard","hentry","category-apple-2","tag-adds","tag-blog","tag-endpoint","tag-events","tag-macos","tag-michael","tag-security","tag-tcc","tag-tsai"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Michael Tsai - Blog - macOS 15.4 Adds TCC Events to Endpoint Security - Som2ny Network<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fivemor.com\/?p=163267\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Michael Tsai - Blog - macOS 15.4 Adds TCC Events to Endpoint Security - Som2ny Network\" \/>\n<meta property=\"og:description\" content=\"Patrick Wardle (tweet): Since TCC is designed to protect these resources, it poses a challenge for malware that often tries to access them. Generally malware takes one of two approaches: exploiting TCC bugs, or obtaining explicit user permission access to the TCC protected item. The former is rather uncommon, while the latter is much more [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fivemor.com\/?p=163267\" \/>\n<meta property=\"og:site_name\" content=\"Som2ny Network\" \/>\n<meta property=\"article:published_time\" content=\"2025-03-29T06:47:11+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fivemor.com\/?p=163267#article\",\"isPartOf\":{\"@id\":\"https:\/\/fivemor.com\/?p=163267\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371\"},\"headline\":\"Michael Tsai &#8211; Blog &#8211; macOS 15.4 Adds TCC Events to Endpoint Security\",\"datePublished\":\"2025-03-29T06:47:11+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fivemor.com\/?p=163267\"},\"wordCount\":192,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fivemor.com\/#organization\"},\"keywords\":[\"Adds\",\"Blog\",\"Endpoint\",\"EVENTS\",\"macos\",\"Michael\",\"Security\",\"TCC\",\"Tsai\"],\"articleSection\":[\"Apple\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fivemor.com\/?p=163267#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fivemor.com\/?p=163267\",\"url\":\"https:\/\/fivemor.com\/?p=163267\",\"name\":\"Michael Tsai - Blog - macOS 15.4 Adds TCC Events to Endpoint Security - Som2ny Network\",\"isPartOf\":{\"@id\":\"https:\/\/fivemor.com\/#website\"},\"datePublished\":\"2025-03-29T06:47:11+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fivemor.com\/?p=163267#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fivemor.com\/?p=163267\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fivemor.com\/?p=163267#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/fivemor.com\/?bp_activities=1\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Michael Tsai &#8211; Blog &#8211; macOS 15.4 Adds TCC Events to Endpoint Security\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fivemor.com\/#website\",\"url\":\"https:\/\/fivemor.com\/\",\"name\":\"Som2ny Network\",\"description\":\"Daily Deals\",\"publisher\":{\"@id\":\"https:\/\/fivemor.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fivemor.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/fivemor.com\/#organization\",\"name\":\"Som2ny Network\",\"url\":\"https:\/\/fivemor.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png\",\"contentUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png\",\"width\":300,\"height\":86,\"caption\":\"Som2ny Network\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/fivemor.com\"],\"url\":\"https:\/\/fivemor.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Michael Tsai - Blog - macOS 15.4 Adds TCC Events to Endpoint Security - Som2ny Network","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fivemor.com\/?p=163267","og_locale":"en_US","og_type":"article","og_title":"Michael Tsai - Blog - macOS 15.4 Adds TCC Events to Endpoint Security - Som2ny Network","og_description":"Patrick Wardle (tweet): Since TCC is designed to protect these resources, it poses a challenge for malware that often tries to access them. Generally malware takes one of two approaches: exploiting TCC bugs, or obtaining explicit user permission access to the TCC protected item. The former is rather uncommon, while the latter is much more [&hellip;]","og_url":"https:\/\/fivemor.com\/?p=163267","og_site_name":"Som2ny Network","article_published_time":"2025-03-29T06:47:11+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fivemor.com\/?p=163267#article","isPartOf":{"@id":"https:\/\/fivemor.com\/?p=163267"},"author":{"name":"admin","@id":"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371"},"headline":"Michael Tsai &#8211; Blog &#8211; macOS 15.4 Adds TCC Events to Endpoint Security","datePublished":"2025-03-29T06:47:11+00:00","mainEntityOfPage":{"@id":"https:\/\/fivemor.com\/?p=163267"},"wordCount":192,"commentCount":0,"publisher":{"@id":"https:\/\/fivemor.com\/#organization"},"keywords":["Adds","Blog","Endpoint","EVENTS","macos","Michael","Security","TCC","Tsai"],"articleSection":["Apple"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fivemor.com\/?p=163267#respond"]}]},{"@type":"WebPage","@id":"https:\/\/fivemor.com\/?p=163267","url":"https:\/\/fivemor.com\/?p=163267","name":"Michael Tsai - Blog - macOS 15.4 Adds TCC Events to Endpoint Security - Som2ny Network","isPartOf":{"@id":"https:\/\/fivemor.com\/#website"},"datePublished":"2025-03-29T06:47:11+00:00","breadcrumb":{"@id":"https:\/\/fivemor.com\/?p=163267#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fivemor.com\/?p=163267"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fivemor.com\/?p=163267#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/fivemor.com\/?bp_activities=1"},{"@type":"ListItem","position":2,"name":"Michael Tsai &#8211; Blog &#8211; macOS 15.4 Adds TCC Events to Endpoint Security"}]},{"@type":"WebSite","@id":"https:\/\/fivemor.com\/#website","url":"https:\/\/fivemor.com\/","name":"Som2ny Network","description":"Daily Deals","publisher":{"@id":"https:\/\/fivemor.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fivemor.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/fivemor.com\/#organization","name":"Som2ny Network","url":"https:\/\/fivemor.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/#\/schema\/logo\/image\/","url":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png","contentUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png","width":300,"height":86,"caption":"Som2ny Network"},"image":{"@id":"https:\/\/fivemor.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png","caption":"admin"},"sameAs":["https:\/\/fivemor.com"],"url":"https:\/\/fivemor.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts\/163267","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=163267"}],"version-history":[{"count":0,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts\/163267\/revisions"}],"wp:attachment":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=163267"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=163267"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=163267"},{"taxonomy":"dealstore","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fdealstore&post=163267"},{"taxonomy":"offerexpiration","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fofferexpiration&post=163267"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}