CatalogLOOBins

ORCHARD · Tool

tccutil

2 techniquesmacOSLOOBinsGPL-3.0

Use the tccutil to reset specific permissions

Defense EvasionmacOS

Banshee Stealer resets the permissions that have already been allowed to applications on the system, which will cause the user to be prompted to give them again. This action may be intended to trick the user into unknowingly giving authorizations to the malware.

tccutil reset AppleEvents
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Defense Evasion
Detection
No detections at time of publishing: No detections at time of publishing

Use the tccutil to reset specific permissions for an application

Defense EvasionmacOS

Attackers use tccutil to reset permissions for services like Camera, Microphone, or AppleEvents.

tccutil reset AppleEvents com.apple.Terminal
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Defense Evasion
Detection
No detections at time of publishing: No detections at time of publishing