tccutil
tccutil is a command-line tool for managing the Transparency, Consent, and Control (TCC) permissions database. It allows users to revoke permissions for applications to access certain system resources, such as the camera, microphone, and location.
Author: Hare Sudhan (@cyb3rbuff) Created: 2025-08-03
Paths
/usr/bin/tccutil Example Use Cases
Use the tccutil to reset specific permissions
Banshee Stealer resets the permissions that have already been allowed to applications on the system, which will cause the user to be prompted to give them again. This action may be intended to trick the user into unknowingly giving authorizations to the malware.
tccutil reset AppleEventsUse the tccutil to reset specific permissions for an application
Attackers use tccutil to reset permissions for services like Camera, Microphone, or AppleEvents.
tccutil reset AppleEvents com.apple.TerminalDetections
- No detections at time of publishing