# sqlite3

> Query and manage sqlite databases.

sqlite is a command-line utility that allows users to query and manage sqlite databases. Many components of macOS and apps used sqlite to store data. Attackers can leverage this tool to discover sensitive data.

- Page: https://loobins.io/binaries/sqlite3/
- Author: Brendan Chamberlain (@infosecB)
- Created: 2023-05-23
- Tactics: Credential Access, Discovery, Collection

## Paths

- `/usr/bin/sqlite3`

## Example Use Cases

### Get apps with Full Disk access

The following command interacts with the TCC (Transparency, Consent, and Control) database to show the apps that have Full Disk access permission

```bash
sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \
'select client from access where auth_value and service = "kTCCServiceSystemPolicyAllFiles"'
```

- Tactics: Discovery
- Tags: permissions

### Get Firefox cookie data

The following one-liner can be used to kill Firefox and dump cookie data from the user's Firefox profile.

```bash
killall firefox; find ~/Library/Application\ Support/Firefox/Profiles/. | grep cookies.sqlite | xargs -I {} sqlite3 {} "select * from moz_cookies"
```

- Tactics: Credential Access, Collection
- Tags: oneliner, cookie-theft

### View URL associated with file downloads

The following sqlite command is commonly used by macOS malware to view the URL in which the payload was downloaded from.

```bash
sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* 'select LSQuarantineDataURLString from LSQuarantineEvent'
```

- Tactics: Credential Access, Collection
- Tags: oneliner, cookie-theft

## Detections

- [Elastic Detection Rules: Potential Privacy Control Bypass via TCCDB Modification](https://github.com/elastic/detection-rules/blob/e9baebc2bc18f90ae16501613cd9521a16a38ad7/rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml)
- [Splunk Security Content: Suspicious SQLite3 LSQuarantine Behavior](https://github.com/splunk/security_content/blob/c65dda5c0aa73a97f28c49c20739971ec1ba18a6/dev/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml#L2)
- [Jamf Protect: Detect SQLite3 activity used to associated URLs with downloaded files](https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/sqlite3_downloads)

## Resources

- [TCC.db Modifier Script](https://github.com/bp88/JSS-Scripts/blob/master/TCC.db%20Modifier.sh)
- [Clipping Silver Sparrow’s wings: Outing macOS malware before it takes flight](https://redcanary.com/blog/clipping-silver-sparrows-wings/)