# tccutil

> Command-line tool for managing the Transparency, Consent, and Control (TCC) permissions database

tccutil is a command-line tool for managing the Transparency, Consent, and Control (TCC) permissions database. It allows users to revoke permissions for applications to access certain system resources, such as the camera, microphone, and location.

- Page: https://loobins.io/binaries/tccutil/
- Author: Hare Sudhan (@cyb3rbuff)
- Created: 2025-08-03
- Tactics: Defense Evasion

## Paths

- `/usr/bin/tccutil`

## Example Use Cases

### Use the tccutil to reset specific permissions

Banshee Stealer resets the permissions that have already been allowed to applications on the system, which will cause the user to be prompted to give them again. This action may be intended to trick the user into unknowingly giving authorizations to the malware.

```bash
tccutil reset AppleEvents
```

- Tactics: Defense Evasion
- Tags: bash, tccutil

### Use the tccutil to reset specific permissions for an application

Attackers use tccutil to reset permissions for services like Camera, Microphone, or AppleEvents.

```bash
tccutil reset AppleEvents com.apple.Terminal
```

- Tactics: Defense Evasion
- Tags: bash, tccutil

## Detections

- No detections at time of publishing

## Resources

- [tccutil](https://ss64.com/mac/tccutil.html)
- [Banshee: The Stealer That "Stole Code" From MacOS XProtect](https://research.checkpoint.com/2025/banshee-macos-stealer-that-stole-code-from-macos-xprotect/)