sqlite3

The following command interacts with the TCC (Transparency, Consent, and Control) database to show the apps that have Full Disk access permission

sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \
'select client from access where auth_value and service = "kTCCServiceSystemPolicyAllFiles"'

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

Elastic Detection Rules: Potential Privacy Control Bypass via TCCDB Modification: github.com/elastic/detection-rules/blob/e9baebc2bc18f90ae16501613cd9521a16a38ad7/rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml

Splunk Security Content: Suspicious SQLite3 LSQuarantine Behavior: github.com/splunk/security_content/blob/c65dda5c0aa73a97f28c49c20739971ec1ba18a6/dev/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml#L2

Jamf Protect: Detect SQLite3 activity used to associated URLs with downloaded files: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/sqlite3_downloads

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sqlite3.yml

github.com/bp88/JSS-Scripts/blob/master/TCC.db%20Modifier.sh

redcanary.com/blog/clipping-silver-sparrows-wings/

The following one-liner can be used to kill Firefox and dump cookie data from the user's Firefox profile.

killall firefox; find ~/Library/Application\ Support/Firefox/Profiles/. | grep cookies.sqlite | xargs -I {} sqlite3 {} "select * from moz_cookies"

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Collection, Credential Access

Detection

Elastic Detection Rules: Potential Privacy Control Bypass via TCCDB Modification: github.com/elastic/detection-rules/blob/e9baebc2bc18f90ae16501613cd9521a16a38ad7/rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml

Splunk Security Content: Suspicious SQLite3 LSQuarantine Behavior: github.com/splunk/security_content/blob/c65dda5c0aa73a97f28c49c20739971ec1ba18a6/dev/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml#L2

Jamf Protect: Detect SQLite3 activity used to associated URLs with downloaded files: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/sqlite3_downloads

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sqlite3.yml

github.com/bp88/JSS-Scripts/blob/master/TCC.db%20Modifier.sh

redcanary.com/blog/clipping-silver-sparrows-wings/

The following sqlite command is commonly used by macOS malware to view the URL in which the payload was downloaded from.

sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* 'select LSQuarantineDataURLString from LSQuarantineEvent'

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Collection, Credential Access

Detection

Elastic Detection Rules: Potential Privacy Control Bypass via TCCDB Modification: github.com/elastic/detection-rules/blob/e9baebc2bc18f90ae16501613cd9521a16a38ad7/rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml

Splunk Security Content: Suspicious SQLite3 LSQuarantine Behavior: github.com/splunk/security_content/blob/c65dda5c0aa73a97f28c49c20739971ec1ba18a6/dev/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml#L2

Jamf Protect: Detect SQLite3 activity used to associated URLs with downloaded files: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/sqlite3_downloads

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sqlite3.yml

github.com/bp88/JSS-Scripts/blob/master/TCC.db%20Modifier.sh

redcanary.com/blog/clipping-silver-sparrows-wings/