Yara entitlements hunting

entitlements.yara

private rule MachO
{
     meta:
        description = "Mach-O executable"
        category = "macho"
    
     condition:
        (uint32(0) == 0xfeedface    or uint32(0) == 0xcafebabe
        or uint32(0) == 0xbebafeca  or uint32(0) == 0xcefaedfe
        or uint32(0) == 0xfeedfacf  or uint32(0) == 0xcffaedfe)
}

private rule TCC_Allow
{
    meta:
        description = "Find binaries with enforced TCC entitlements"

    strings:
        $s1 = "<key>com.apple.private.tcc.allow</key>"

    condition:
        all of them
}

private rule Sandbox
{
    meta:
        description = "Find binaries with Sandbox entitlement"

    strings:
        $r1 = /<key>com\.apple\.security\.app-sandbox<\/key>\s*<true\/>/

    condition:
        all of them
}

rule TCC_FDA
{
    meta:
        description = "Find binaries with enforced FDA (Full Disk Access) entitlement"

    strings:
        $s1 = "<string>kTCCServiceSystemPolicyAllFiles</string>"

    condition:
        MachO and TCC_Allow and all of them
}


rule TCC_SysAdminFiles
{
    meta:
        description = "Find binaries with enforced SysAdminFiles (cron, OD, other settings) entitlement"

    strings:
        $s1 = "<string>kTCCServiceSystemPolicySysAdminFiles</string>"

    condition:
        MachO and TCC_Allow and all of them
}


rule TCC_Accessibility
{
    meta:
        description = "Find binaries with Accessibility (control computer) entitlement"

    strings:
        $s1 = "<string>kTCCServiceAccessibility</string>"

    condition:
        MachO and TCC_Allow and all of them
}

rule TCC_AppleEvents
{
    meta:
        description = "Find binaries with AppleEvents (automation) entitlement"

    strings:
        $s1 = "<string>kTCCServiceAppleEvents</string>"

    condition:
        MachO and TCC_Allow and all of them
}

rule TCC_PostEvent
{
    meta:
        description = "Find binaries with PostEvent (send keystrokes) entitlement"

    strings:
        $s1 = "<string>kTCCServicePostEvent</string>"

    condition:
        MachO and TCC_Allow and all of them
}

rule TCC_ListenEvent
{
    meta:
        description = "Find binaries with ListenEvent (input monitoring) entitlement"

    strings:
        $s1 = "<string>kTCCServiceListenEvent</string>"

    condition:
        MachO and TCC_Allow and all of them
}


rule Sanbox_FDA
{
    meta:
        description = "Find binaries with enforced sandbox FDA entitlement"

    strings:
        $s1 = "<key>com.apple.security.temporary-exception.files.absolute-path.read-write</key>"
        $s2 = "<string>/</string>"

    condition:
        MachO and Sandbox and all of them
}

rule TCC_Manager
{
    meta:
        description = "Find binaries that can modify TCC preferences"

    strings:
        $s1 = "<key>com.apple.private.tcc.manager</key>"

    condition:
        MachO and all of them
}

rule Rootless_Install
{
    meta:
        description = "Find binaries that can modify SIP protected files"

    strings:
        $r1 = /<key>com\.apple\.rootless\.install<\/key>\s*<true\/>/

    condition:
        MachO and all of them
}

rule Rootless_Install_Heritable
{
    meta:
        description = "Find binaries that can modify SIP protected files, child processes also"

    strings:
        $r1 = /<key>com\.apple\.rootless\.install\.heritable<\/key>\s*<true\/>/

    condition:
        MachO and all of them
}

rule Configuration_Profiles
{
    meta:
        description = "Find binaries that can modify Configuration Profiles"

    strings:
        $r1 = /<key>com\.apple\.private\.configurationprofiles\.readwrite<\/key>\s*<true\/>/

    condition:
        MachO and all of them
}

rule No_Library_Validation
{
    meta:
        description = "Find binaries with disable library validation entitlement"

    strings:
        $r1 = /<key>com\.apple\.security\.cs\.disable\-library\-validation<\/key>\s*<true\/>/

    condition:
        MachO and all of them
}

rule Task_Ports
{
    meta:
        description = "Find binaries that can access System Task Ports"

    strings:
        $r1 = /<key>com\.apple\.system\-task\-ports<\/key>\s*<true\/>/

    condition:
        MachO and all of them
}

scan-list.txt

/bin
/sbin
/usr
/System/Applications
/System/Developer
/System/DriverKit
/System/iOSSupport
/System/Library
/Applications/Utilities
/Library

yara-scan.sh

#!/bin/sh

YARA_BIN="$(which yara)"
if [ -z "$YARA_BIN" ]; then
  echo 'Error: Yara binary not found, use "brew install yara"'
  exit 1
fi

# recursively scan files/folders from the specified list, skipping symlinks
sudo $YARA_BIN -N -r --scan-list ./entitlements.yara ./scan-list.txt 2>/dev/null

z-yara-scan-bigsur.txt

TCC_Manager /usr/bin/brctl
TCC_AppleEvents /usr/bin/fdesetup
ConfigurationProfiles /usr/bin/fdesetup
ConfigurationProfiles /usr/bin/profiles
TCC_FDA /usr/libexec/taskgated-helper
TCC_FDA /usr/libexec/testmanagerd
TCC_FDA /usr/libexec/AppleQEMUGuestAgent
TCC_FDA /usr/libexec/taskgated
Rootless_Install /usr/libexec/rootless-init
TCC_FDA /usr/libexec/lsd
TCC_PostEvent /usr/libexec/SidecarDisplayAgent
TCC_FDA /usr/libexec/amfid
TCC_PostEvent /usr/libexec/hidd
Rootless_Install /usr/libexec/bootinstalld
TCC_Manager /usr/libexec/fmfd
TCC_Manager /usr/libexec/siriknowledged
TCC_Manager /usr/libexec/pkd
TCC_FDA /usr/libexec/containermanagerd
ConfigurationProfiles /usr/libexec/dmd
TCC_FDA /usr/libexec/syspolicyd
TCC_Manager /usr/libexec/syspolicyd
TCC_FDA /usr/libexec/warmd_agent
Rootless_Install /usr/libexec/logd_helper
TCC_Manager /usr/libexec/endpointsecurityd
TCC_FDA /usr/libexec/kernelmanagerd
TCC_FDA /usr/libexec/sandboxd
TCC_PostEvent /usr/sbin/screencapture
TCC_Manager /usr/sbin/appleh13camerad
TCC_FDA /usr/sbin/filecoordinationd
TCC_FDA /usr/libexec/secinitd
TCC_Manager /usr/sbin/universalaccessd
TCC_FDA /usr/sbin/securityd
TCC_AppleEvents /usr/libexec/mdmclient
TCC_PostEvent /usr/libexec/mdmclient
TCC_Manager /usr/libexec/mdmclient
ConfigurationProfiles /usr/libexec/mdmclient
TCC_Manager /usr/sbin/applecamerad
Rootless_Install /usr/libexec/diskmanagementd
Rootless_Install_Heritable /usr/libexec/diskmanagementd
TCC_Manager /usr/libexec/remindd
TCC_FDA /System/Applications/Music.app/Contents/MacOS/Music
TCC_AppleEvents /System/Applications/Music.app/Contents/MacOS/Music
TCC_FDA /System/Applications/Image Capture.app/Contents/MacOS/Image Capture
TCC_Manager /System/Applications/Mail.app/Contents/PlugIns/com.apple.mail.SpotlightIndexExtension.appex/Contents/MacOS/com.apple.mail.SpotlightIndexExtension
TCC_AppleEvents /System/Applications/Contacts.app/Contents/MacOS/Contacts
TCC_Manager /System/Applications/Contacts.app/Contents/MacOS/Contacts
TCC_FDA /System/Applications/TV.app/Contents/MacOS/TV
TCC_AppleEvents /System/Applications/TV.app/Contents/MacOS/TV
TCC_FDA /System/Applications/Utilities/System Information.app/Contents/MacOS/System Information
TCC_AppleEvents /System/Applications/Utilities/System Information.app/Contents/MacOS/System Information
TCC_PostEvent /System/Applications/Utilities/System Information.app/Contents/MacOS/System Information
TCC_AppleEvents /System/Applications/Utilities/Script Editor.app/Contents/MacOS/Script Editor
TCC_FDA /System/Applications/Utilities/Boot Camp Assistant.app/Contents/XPCServices/bootcampassistantinstalld.xpc/Contents/MacOS/bootcampassistantinstalld
TCC_Manager /System/Applications/VoiceMemos.app/Contents/MacOS/VoiceMemos
TCC_Manager /System/Applications/Reminders.app/Contents/MacOS/Reminders
TCC_AppleEvents /System/Applications/Automator.app/Contents/MacOS/Automator
TCC_Manager /System/Applications/Calendar.app/Contents/MacOS/Calendar
TCC_Manager /System/iOSSupport/System/Library/PrivateFrameworks/VoiceMemos.framework/Support/voicememod
TCC_FDA /System/Library/CoreServices/Dock.app/Contents/MacOS/Dock
TCC_AppleEvents /System/Library/CoreServices/Dock.app/Contents/MacOS/Dock
TCC_PostEvent /System/Library/CoreServices/Dock.app/Contents/MacOS/Dock
Sanbox_FDA /System/Library/CoreServices/Siri.app/Contents/XPCServices/SiriNCService.xpc/Contents/MacOS/SiriNCService
TCC_FDA /System/Library/CoreServices/VoiceOver.app/Contents/MacOS/VoiceOver
TCC_FDA /System/Library/CoreServices/VoiceOver.app/Contents/MacOS/VoiceOverStarter
TCC_FDA /System/Library/CoreServices/sharedfilelistd
TCC_AppleEvents /System/Library/CoreServices/ScreenSaverEngine.app/Contents/MacOS/ScreenSaverEngine
Sanbox_FDA /System/Library/CoreServices/ScreenSaverEngine.app/Contents/MacOS/ScreenSaverEngine
TCC_FDA /System/Library/CoreServices/backupd.bundle/Contents/Resources/backupd-helper
TCC_FDA /System/Library/CoreServices/backupd.bundle/Contents/Resources/backupd
TCC_AppleEvents /System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer
TCC_FDA /System/Library/CoreServices/launchservicesd
Rootless_Install /System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd
TCC_FDA /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder
TCC_AppleEvents /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder
TCC_PostEvent /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder
TCC_FDA /System/Library/CoreServices/backgroundtaskmanagementagent
Sanbox_FDA /System/Library/CoreServices/NotificationCenter.app/Contents/MacOS/NotificationCenter
TCC_AppleEvents /System/Library/CoreServices/Script Menu.app/Contents/MacOS/Script Menu
Rootless_Install /System/Library/CoreServices/Setup Assistant.app/Contents/Resources/mbsystemadministration
TCC_FDA /System/Library/CoreServices/RemoteManagement/screensharingd.bundle/Contents/Support/SSFileCopySender.bundle/Contents/MacOS/SSFileCopySender
Sanbox_FDA /System/Library/CoreServices/RemoteManagement/screensharingd.bundle/Contents/Support/SSFileCopySender.bundle/Contents/MacOS/SSFileCopySender
TCC_FDA /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent
TCC_PostEvent /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/MacOS/AppleVNCServer
Sanbox_FDA /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/MacOS/AppleVNCServer
TCC_PostEvent /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Support/SSDragHelper.app/Contents/MacOS/SSDragHelper
TCC_PostEvent /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow
TCC_FDA /System/Library/CoreServices/CoreServicesUIAgent.app/Contents/MacOS/CoreServicesUIAgent
TCC_AppleEvents /System/Library/CoreServices/CoreServicesUIAgent.app/Contents/MacOS/CoreServicesUIAgent
TCC_FDA /System/Library/CoreServices/DiskImageMounter.app/Contents/MacOS/DiskImageMounter
TCC_FDA /System/Library/CoreServices/ReportCrash
TCC_PostEvent /System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/MacOS/Feedback Assistant
TCC_AppleEvents /System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService
TCC_FDA /System/Library/CoreServices/Spotlight.app/Contents/MacOS/Spotlight
TCC_AppleEvents /System/Library/CoreServices/Spotlight.app/Contents/MacOS/Spotlight
TCC_Manager /System/Library/CoreServices/appleeventsd
TCC_PostEvent /System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
TCC_AppleEvents /System/Library/CoreServices/iCloud.app/Contents/MacOS/iCloud
TCC_Manager /System/Library/CoreServices/iCloud.app/Contents/MacOS/iCloud
TCC_FDA /System/Library/CoreServices/iconservicesagent
TCC_FDA /System/Library/CoreServices/pbs
TCC_Manager /System/Library/TextInput/kbd
TCC_Manager /System/Library/PreferencePanes/Bluetooth.prefPane/Contents/XPCServices/com.apple.preferences.Bluetooth.remoteservice.xpc/Contents/MacOS/com.apple.preferences.Bluetooth.remoteservice
TCC_FDA /System/Library/PreferencePanes/TimeMachine.prefPane/Contents/XPCServices/com.apple.prefs.backup.remoteservice.xpc/Contents/MacOS/com.apple.prefs.backup.remoteservice
TCC_FDA /System/Library/PreferencePanes/DesktopScreenEffectsPref.prefPane/Contents/Resources/DesktopPictures.prefPane/Contents/XPCServices/com.apple.preference.desktopscreeneffect.desktop.remoteservice.xpc/Contents/MacOS/com.apple.preference.desktopscreeneffect.desktop.remoteservice
TCC_FDA /System/Library/PreferencePanes/Security.prefPane/Contents/XPCServices/com.apple.preference.security.remoteservice.xpc/Contents/MacOS/com.apple.preference.security.remoteservice
TCC_Manager /System/Library/PreferencePanes/Security.prefPane/Contents/XPCServices/com.apple.preference.security.remoteservice.xpc/Contents/MacOS/com.apple.preference.security.remoteservice
TCC_Manager /System/Library/PreferencePanes/InternetAccounts.prefPane/Contents/XPCServices/com.apple.preferences.internetaccounts.remoteservice.xpc/Contents/MacOS/com.apple.preferences.internetaccounts.remoteservice
TCC_FDA /System/Library/PreferencePanes/Accounts.prefPane/Contents/XPCServices/com.apple.preferences.users.remoteservice.xpc/Contents/MacOS/com.apple.preferences.users.remoteservice
TCC_Manager /System/Library/PreferencePanes/AppleIDPrefPane.prefPane/Contents/XPCServices/com.apple.preferences.AppleIDPrefPane.remoteservice.xpc/Contents/MacOS/com.apple.preferences.AppleIDPrefPane.remoteservice
TCC_FDA /System/Library/PreferencePanes/SharingPref.prefPane/Contents/XPCServices/com.apple.preferences.sharing.remoteservice.xpc/Contents/MacOS/com.apple.preferences.sharing.remoteservice
TCC_AppleEvents /System/Library/PreferencePanes/Profiles.prefPane/Contents/XPCServices/com.apple.preferences.configurationprofiles.remoteservice.xpc/Contents/MacOS/com.apple.preferences.configurationprofiles.remoteservice
TCC_AppleEvents /System/Library/Templates/Data/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
TCC_FDA /System/Library/Templates/Data/Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker
Rootless_Install_Heritable /System/Library/AssetsV2/com_apple_MobileAsset_MobileSoftwareUpdate_MacUpdateBrain/da5d62d8c2f41753f8be9601bef9d361f044e285.asset/AssetData/com.apple.MobileSoftwareUpdate.UpdateBrainService.xpc/Contents/MacOS/com.apple.MobileSoftwareUpdate.UpdateBrainService
Rootless_Install /System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/system_shove
Rootless_Install /System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/deferred_install
TCC_Manager /System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/installd
TCC_Manager /System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/system_installd
Rootless_Install_Heritable /System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/system_installd
TCC_AppleEvents /System/Library/PrivateFrameworks/AMPDevices.framework/Versions/A/Support/AMPDevicesAgent
TCC_Manager /System/Library/PrivateFrameworks/UniversalAccess.framework/Versions/A/Resources/universalAccessAuthWarn.app/Contents/MacOS/universalAccessAuthWarn
TCC_Manager /System/Library/PrivateFrameworks/iTunesCloud.framework/Support/itunescloudd
TCC_Manager /System/Library/PrivateFrameworks/ConfigurationProfiles.framework/XPCServices/AssessmentService.xpc/Contents/MacOS/AssessmentService
TCC_FDA /System/Library/PrivateFrameworks/TCC.framework/Versions/A/Resources/tccd
TCC_Manager /System/Library/PrivateFrameworks/TCC.framework/Versions/A/Resources/tccd
TCC_PostEvent /System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/Resources/WindowServer
TCC_Manager /System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/Resources/WindowServer
TCC_Manager /System/Library/PrivateFrameworks/PreferencePanesSupport.framework/PlugIns/PrivacyPhotos.appex/Contents/MacOS/PrivacyPhotos
TCC_Manager /System/Library/PrivateFrameworks/CalendarAgent.framework/Executables/CalendarAgent
TCC_AppleEvents /System/Library/PrivateFrameworks/AMPSharing.framework/Versions/A/Support/mediasharingd
TCC_AppleEvents /System/Library/PrivateFrameworks/AMPSharing.framework/Versions/A/PlugIns/SharingPrefsExtension.appex/Contents/MacOS/SharingPrefsExtension
TCC_FDA /System/Library/PrivateFrameworks/SystemMigration.framework/Versions/A/Resources/migrationhelper
TCC_Manager /System/Library/PrivateFrameworks/AssetsLibraryServices.framework/Versions/A/XPCServices/com.apple.Photos.Migration.Reader.xpc/Contents/MacOS/com.apple.Photos.Migration.Reader
TCC_FDA /System/Library/PrivateFrameworks/SystemMigration.framework/Versions/A/Resources/systemmigrationd
TCC_Manager /System/Library/PrivateFrameworks/SystemMigration.framework/Versions/A/Resources/systemmigrationd
Rootless_Install_Heritable /System/Library/PrivateFrameworks/SystemMigration.framework/Versions/A/Resources/systemmigrationd
TCC_FDA /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/Resources/DesktopServicesHelper
TCC_FDA /System/Library/PrivateFrameworks/AMPLibrary.framework/Versions/A/Support/AMPLibraryAgent
TCC_AppleEvents /System/Library/PrivateFrameworks/AMPLibrary.framework/Versions/A/Support/AMPLibraryAgent
TCC_FDA /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/DeveloperStorageExtension.appex/Contents/MacOS/DeveloperStorageExtension
TCC_FDA /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/GarageBandStorageExtension.appex/Contents/MacOS/GarageBandStorageExtension
TCC_FDA /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/CloudFilesStorageExtension.appex/Contents/MacOS/CloudFilesStorageExtension
TCC_FDA /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/TrashStorageExtension.appex/Contents/MacOS/TrashStorageExtension
TCC_FDA /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/OtherUsersStorageExtension.appex/Contents/MacOS/OtherUsersStorageExtension
TCC_FDA /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/AppleInternalStorageExtension.appex/Contents/MacOS/AppleInternalStorageExtension
TCC_FDA /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/iOSFilesStorageExtension.appex/Contents/MacOS/iOSFilesStorageExtension
TCC_FDA /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/ApplicationsStorageExtension.appex/Contents/MacOS/ApplicationsStorageExtension
TCC_FDA /System/Library/PrivateFrameworks/StorageManagement.framework/Versions/A/Resources/diskspaced
TCC_Manager /System/Library/PrivateFrameworks/CalendarNotification.framework/Versions/A/XPCServices/CalNCService.xpc/Contents/MacOS/CalNCService
TCC_AppleEvents /System/Library/PrivateFrameworks/ShareKit.framework/Versions/A/PlugIns/ShareMailBack.appex/Contents/MacOS/ShareMailBack
TCC_AppleEvents /System/Library/PrivateFrameworks/ShareKit.framework/Versions/A/PlugIns/ShareMail.appex/Contents/MacOS/ShareMail
TCC_AppleEvents /System/Library/PrivateFrameworks/ShareKit.framework/Versions/A/PlugIns/SystemSetAccountPicture.appex/Contents/MacOS/SystemSetAccountPicture
TCC_AppleEvents /System/Library/PrivateFrameworks/ShareKit.framework/Versions/A/PlugIns/SystemSetDesktopImage.appex/Contents/MacOS/SystemSetDesktopImage
TCC_AppleEvents /System/Library/PrivateFrameworks/ShareKit.framework/Versions/A/PlugIns/SystemAddToReadingList.appex/Contents/MacOS/SystemAddToReadingList
Rootless_Install /System/Library/PrivateFrameworks/ShoveService.framework/Versions/A/XPCServices/SystemShoveService.xpc/Contents/MacOS/SystemShoveService
TCC_Manager /System/Library/PrivateFrameworks/TelephonyUtilities.framework/callservicesd
TCC_AppleEvents /System/Library/PrivateFrameworks/ScreenReader.framework/Versions/A/Frameworks/ScreenReaderOutput.framework/Versions/A/Resources/scrod
TCC_FDA /System/Library/PrivateFrameworks/SharePointManagement.framework/XPCServices/SharePointManagementService.xpc/Contents/MacOS/SharePointManagementService
TCC_Manager /System/Library/PrivateFrameworks/GameCenterFoundation.framework/Versions/A/gamed
TCC_FDA /System/Library/PrivateFrameworks/DiskImages.framework/Versions/A/Resources/diskimages-helper
TCC_FDA /System/Library/PrivateFrameworks/RemoteViewServices.framework/XPCServices/com.apple.security.pboxd.xpc/Contents/MacOS/com.apple.security.pboxd
TCC_FDA /System/Library/PrivateFrameworks/UserActivity.framework/Agents/useractivityd
TCC_FDA /System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
TCC_Manager /System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
TCC_Manager /System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
TCC_Manager /System/Library/PrivateFrameworks/CloudKitDaemon.framework/Support/cloudd
TCC_FDA /System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistant_service
TCC_Manager /System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistant_service
Rootless_Install_Heritable /System/Library/PrivateFrameworks/MobileSoftwareUpdate.framework/Versions/A/XPCServices/com.apple.MobileSoftwareUpdate.CleanupPreparePathService.xpc/Contents/MacOS/com.apple.MobileSoftwareUpdate.CleanupPreparePathService
TCC_FDA /System/Library/PrivateFrameworks/CloudPhotoLibrary.framework/Versions/A/Support/cloudphotod
TCC_Manager /System/Library/PrivateFrameworks/BookKit.framework/Versions/A/XPCServices/com.apple.BKAgentService.xpc/Contents/MacOS/com.apple.BKAgentService
TCC_FDA /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeassetd
Rootless_Install_Heritable /System/Library/PrivateFrameworks/StorageKit.framework/Versions/A/Resources/storagekitd
TCC_Manager /System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
TCC_Manager /System/Library/PrivateFrameworks/SystemAdministration.framework/Versions/A/Resources/UpdateSettingsTool
TCC_FDA /System/Library/PrivateFrameworks/SystemAdministration.framework/XPCServices/writeconfig.xpc/Contents/MacOS/writeconfig
TCC_Manager /System/Library/PrivateFrameworks/SystemAdministration.framework/XPCServices/writeconfig.xpc/Contents/MacOS/writeconfig
TCC_Manager /System/Library/PrivateFrameworks/VideoSubscriberAccountUI.framework/Versions/A/PlugIns/VideoSubscriberAccountAuthenticationExtension.appex/Contents/MacOS/VideoSubscriberAccountAuthenticationExtension
TCC_Manager /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
TCC_Manager /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/XPCServices/ContainerMetadataExtractor.xpc/Contents/MacOS/ContainerMetadataExtractor
TCC_FDA /System/Library/PrivateFrameworks/PodcastServices.framework/XPCServices/PodcastContentService.xpc/Contents/MacOS/PodcastContentService
TCC_Manager /System/Library/PrivateFrameworks/PhotoLibraryServices.framework/Versions/A/Support/photolibraryd
TCC_Manager /System/Library/PrivateFrameworks/AppleMediaServices.framework/Versions/A/Resources/amsaccountsd
TCC_Manager /System/Library/PrivateFrameworks/SyncedDefaults.framework/Support/syncdefaultsd
TCC_AppleEvents /System/Library/PrivateFrameworks/DataDetectors.framework/Versions/A/XPCServices/DataDetectorsActionService.xpc/Contents/MacOS/DataDetectorsActionService
TCC_Manager /System/Library/PrivateFrameworks/HomeKitDaemon.framework/Support/homed
TCC_FDA /System/Library/PrivateFrameworks/LibraryRepair.framework/Versions/A/XPCServices/com.apple.library-repair.agent.xpc/Contents/MacOS/com.apple.library-repair.agent
TCC_AppleEvents /System/Library/Frameworks/SafariServices.framework/Versions/A/XPCServices/com.apple.SafariServices.ExtensionHelper.xpc/Contents/MacOS/com.apple.SafariServices.ExtensionHelper
TCC_Manager /System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/AppleCamera.plugin/Contents/Resources/AppleCameraAssistant
TCC_Manager /System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/iOSScreenCapture.plugin/Contents/Resources/iOSScreenCaptureAssistant
TCC_Manager /System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/VDC.plugin/Contents/Resources/VDCAssistant
TCC_Manager /System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/AVC.plugin/Contents/Resources/AVCAssistant
TCC_Manager /System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/IIDC.plugin/Contents/Resources/IIDCVideoAssistant
TCC_FDA /System/Library/Frameworks/ScreenSaver.framework/PlugIns/iLifeSlideshows.appex/Contents/MacOS/iLifeSlideshows
Sanbox_FDA /System/Library/Frameworks/ScreenSaver.framework/PlugIns/iLifeSlideshows.appex/Contents/MacOS/iLifeSlideshows
TCC_FDA /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/Support/fontmover
TCC_FDA /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/Support/FontValidator
TCC_FDA /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/Support/fontd
TCC_FDA /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/com.apple.CodeSigningHelper.xpc/Contents/MacOS/com.apple.CodeSigningHelper
TCC_Manager /System/Library/Frameworks/MediaLibrary.framework/Versions/A/XPCServices/com.apple.MediaLibraryService.xpc/Contents/MacOS/com.apple.MediaLibraryService
TCC_FDA /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdwrite
TCC_Manager /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/corespotlightd
TCC_FDA /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdsync
TCC_FDA /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdworker_shared
TCC_FDA /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mds
TCC_FDA /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/DocumentPopoverViewService.xpc/Contents/MacOS/DocumentPopoverViewService
TCC_FDA /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/com.apple.appkit.xpc.openAndSavePanelService.xpc/Contents/MacOS/com.apple.appkit.xpc.openAndSavePanelService
TCC_AppleEvents /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/com.apple.appkit.xpc.openAndSavePanelService.xpc/Contents/MacOS/com.apple.appkit.xpc.openAndSavePanelService
TCC_Manager /System/Library/Frameworks/FileProvider.framework/Support/fileproviderd
TCC_Manager /System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd
TCC_FDA /System/Library/Frameworks/QuickLook.framework/Versions/A/Resources/quicklookd.app/Contents/MacOS/quicklookd
TCC_Manager /System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
TCC_PostEvent /System/Library/Input Methods/TrackpadIM.app/Contents/PlugIns/TIM_Extension.appex/Contents/MacOS/TIM_Extension
TCC_PostEvent /System/Library/Input Methods/50onPaletteServer.app/Contents/MacOS/50onPaletteServer
TCC_AppleEvents /System/Library/Input Methods/Assistive Control.app/Contents/MacOS/Assistive Control
TCC_AppleEvents /System/Library/Services/Spotlight.service/Contents/MacOS/Spotlight
TCC_FDA /System/Library/InternetAccounts/internetAccountsMigrator
TCC_AppleEvents /Library/Apple/System/Library/StagedFrameworks/Safari/SafariServices.framework/Versions/A/XPCServices/com.apple.SafariServices.ExtensionHelper.xpc/Contents/MacOS/com.apple.SafariServices.ExtensionHelper
TCC_AppleEvents /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent

z-yara-scan-mojave.txt

TCC_Manager /usr/bin/brctl
TCC_FDA /usr/bin/mdutil
TCC_Manager /usr/bin/tccutil
ConfigurationProfiles /usr/bin/profiles
TCC_AppleEvents /usr/bin/fdesetup
TCC_FDA /usr/libexec/AppSandbox/ContainerRepairAgent
Rootless_Install /usr/libexec/rootless-init
TCC_Manager /usr/libexec/fmfd
Rootless_Install /usr/libexec/x11-select
TCC_Manager /usr/libexec/pkd
ConfigurationProfiles /usr/libexec/dmd
TCC_Manager /usr/libexec/sandboxd
TCC_FDA /usr/libexec/amfid
Rootless_Install /usr/libexec/bootinstalld
Rootless_Install /usr/libexec/atomicupdatetool
TCC_AppleEvents /usr/libexec/mdmclient
TCC_PostEvent /usr/libexec/mdmclient
TCC_Manager /usr/libexec/mdmclient
ConfigurationProfiles /usr/libexec/mdmclient
Rootless_Install /usr/libexec/diskmanagementd
Rootless_Install_Heritable /usr/libexec/diskmanagementd
TCC_FDA /usr/libexec/defragx
TCC_FDA /usr/sbin/filecoordinationd
TCC_FDA /usr/sbin/screencapture
TCC_PostEvent /usr/sbin/screencapture
Rootless_Install /usr/sbin/kextcache
TCC_Manager /usr/sbin/universalaccessd
TCC_Manager /usr/sbin/coreaudiod
TCC_Manager /usr/lib/log/liblog_location.dylib
TCC_Manager /Library/Developer/PrivateFrameworks/CoreSimulator.framework/Versions/A/XPCServices/SimulatorTrampoline.xpc/Contents/MacOS/SimulatorTrampoline
TCC_Manager /Library/CoreMediaIO/Plug-Ins/DAL/AppleCamera.plugin/Contents/Resources/AppleCameraAssistant
TCC_Manager /System/iOSSupport/System/Library/PrivateFrameworks/VoiceMemos.framework/Support/voicememod
TCC_AppleEvents /System/Library/CoreServices/Dock.app/Contents/MacOS/Dock
TCC_PostEvent /System/Library/CoreServices/Dock.app/Contents/MacOS/Dock
Rootless_Install /System/Library/CoreServices/slodDiskLabeler
TCC_FDA /System/Library/CoreServices/sharedfilelistd
TCC_FDA /System/Library/CoreServices/backupd.bundle/Contents/Resources/backupd
TCC_AppleEvents /System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer
TCC_FDA /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder
TCC_AppleEvents /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder
TCC_PostEvent /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder
TCC_FDA /System/Library/CoreServices/backgroundtaskmanagementagent
TCC_AppleEvents /System/Library/CoreServices/Script Menu.app/Contents/MacOS/Script Menu
TCC_PostEvent /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/MacOS/AppleVNCServer
Sanbox_FDA /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/MacOS/AppleVNCServer
TCC_PostEvent /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Support/SSDragHelper.app/Contents/MacOS/SSDragHelper
TCC_PostEvent /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow
TCC_FDA /System/Library/CoreServices/CoreServicesUIAgent.app/Contents/MacOS/CoreServicesUIAgent
TCC_AppleEvents /System/Library/CoreServices/CoreServicesUIAgent.app/Contents/MacOS/CoreServicesUIAgent
TCC_FDA /System/Library/CoreServices/DiskImageMounter.app/Contents/MacOS/DiskImageMounter
TCC_FDA /System/Library/CoreServices/screencaptureui.app/Contents/MacOS/screencaptureui
TCC_AppleEvents /System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
TCC_PostEvent /System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/MacOS/Feedback Assistant
TCC_AppleEvents /System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility
TCC_FDA /System/Library/CoreServices/Spotlight.app/Contents/MacOS/Spotlight
TCC_AppleEvents /System/Library/CoreServices/Spotlight.app/Contents/MacOS/Spotlight
TCC_Manager /System/Library/CoreServices/appleeventsd
TCC_AppleEvents /System/Library/CoreServices/iCloud.app/Contents/MacOS/iCloud
TCC_Manager /System/Library/CoreServices/iCloud.app/Contents/MacOS/iCloud
TCC_FDA /System/Library/CoreServices/pbs
TCC_Manager /System/Library/TextInput/kbd
TCC_Manager /System/Library/PreferencePanes/Security.prefPane/Contents/XPCServices/com.apple.preference.security.remoteservice.xpc/Contents/MacOS/com.apple.preference.security.remoteservice
TCC_Manager /System/Library/PreferencePanes/InternetAccounts.prefPane/Contents/XPCServices/com.apple.preferences.internetaccounts.remoteservice.xpc/Contents/MacOS/com.apple.preferences.internetaccounts.remoteservice
TCC_Manager /System/Library/PreferencePanes/iCloudPref.prefPane/Contents/XPCServices/com.apple.preferences.icloud.remoteservice.xpc/Contents/MacOS/com.apple.preferences.icloud.remoteservice
TCC_AppleEvents /System/Library/PreferencePanes/Profiles.prefPane/Contents/XPCServices/com.apple.preferences.configurationprofiles.remoteservice.xpc/Contents/MacOS/com.apple.preferences.configurationprofiles.remoteservice
TCC_Manager /System/Library/PreferencePanes/ParentalControls.prefPane/Contents/XPCServices/com.apple.preferences.parentalcontrols.remoteservice.xpc/Contents/MacOS/com.apple.preferences.parentalcontrols.remoteservice
Rootless_Install /System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/system_shove
Rootless_Install /System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/deferred_install
TCC_Manager /System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/installd
Rootless_Install_Heritable /System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/system_installd
TCC_Manager /System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/XPCServices/package_script_service.xpc/Contents/MacOS/package_script_service
TCC_Manager /System/Library/PrivateFrameworks/UniversalAccess.framework/Versions/A/Resources/universalAccessAuthWarn.app/Contents/MacOS/universalAccessAuthWarn
TCC_Manager /System/Library/PrivateFrameworks/ConfigurationProfiles.framework/XPCServices/AssessmentService.xpc/Contents/MacOS/AssessmentService
TCC_Manager /System/Library/PrivateFrameworks/TCC.framework/Versions/A/Resources/tccd
TCC_Manager /System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/Resources/WindowServer
Sanbox_FDA /System/Library/PrivateFrameworks/MessagesKit.framework/Versions/A/Resources/soagent.app/Contents/MacOS/soagent
TCC_Manager /System/Library/PrivateFrameworks/CalendarAgent.framework/Executables/CalendarAgent
TCC_Manager /System/Library/PrivateFrameworks/AssetsLibraryServices.framework/Versions/A/XPCServices/com.apple.Photos.Migration.Reader.xpc/Contents/MacOS/com.apple.Photos.Migration.Reader
TCC_FDA /System/Library/PrivateFrameworks/SystemMigration.framework/Versions/A/Resources/migrationhelper
TCC_FDA /System/Library/PrivateFrameworks/SystemMigration.framework/Versions/A/Resources/systemmigrationd
TCC_Manager /System/Library/PrivateFrameworks/SystemMigration.framework/Versions/A/Resources/systemmigrationd
Rootless_Install_Heritable /System/Library/PrivateFrameworks/SystemMigration.framework/Versions/A/Resources/systemmigrationd
TCC_FDA /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/Resources/DesktopServicesHelper
TCC_FDA /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/OtherUsersExtension.appex/Contents/MacOS/OtherUsersExtension
TCC_FDA /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/Applications.appex/Contents/MacOS/Applications
TCC_FDA /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/iOSFilesExtension.appex/Contents/MacOS/iOSFilesExtension
TCC_FDA /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/GarageBandExtension.appex/Contents/MacOS/GarageBandExtension
Sanbox_FDA /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/GarageBandExtension.appex/Contents/MacOS/GarageBandExtension
TCC_FDA /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/Trash.appex/Contents/MacOS/Trash
TCC_FDA /System/Library/PrivateFrameworks/StorageManagement.framework/Versions/A/Resources/diskspaced
TCC_Manager /System/Library/PrivateFrameworks/CalendarNotification.framework/Versions/A/XPCServices/CalNCService.xpc/Contents/MacOS/CalNCService
TCC_AppleEvents /System/Library/PrivateFrameworks/ShareKit.framework/Versions/A/PlugIns/ShareMailBack.appex/Contents/MacOS/ShareMailBack
TCC_AppleEvents /System/Library/PrivateFrameworks/ShareKit.framework/Versions/A/PlugIns/ShareMail.appex/Contents/MacOS/ShareMail
TCC_AppleEvents /System/Library/PrivateFrameworks/ShareKit.framework/Versions/A/PlugIns/SystemSetAccountPicture.appex/Contents/MacOS/SystemSetAccountPicture
TCC_AppleEvents /System/Library/PrivateFrameworks/ShareKit.framework/Versions/A/PlugIns/SystemSetDesktopImage.appex/Contents/MacOS/SystemSetDesktopImage
TCC_AppleEvents /System/Library/PrivateFrameworks/ShareKit.framework/Versions/A/PlugIns/SystemSetBuddyPicture.appex/Contents/MacOS/SystemSetBuddyPicture
TCC_AppleEvents /System/Library/PrivateFrameworks/ShareKit.framework/Versions/A/PlugIns/SystemAddToReadingList.appex/Contents/MacOS/SystemAddToReadingList
TCC_Manager /System/Library/PrivateFrameworks/TelephonyUtilities.framework/callservicesd
TCC_AppleEvents /System/Library/PrivateFrameworks/ScreenReader.framework/Versions/A/Frameworks/ScreenReaderOutput.framework/Versions/A/Resources/scrod
TCC_FDA /System/Library/PrivateFrameworks/SharePointManagement.framework/XPCServices/SharePointManagementService.xpc/Contents/MacOS/SharePointManagementService
TCC_Manager /System/Library/PrivateFrameworks/GameCenterFoundation.framework/Versions/A/gamed
TCC_FDA /System/Library/PrivateFrameworks/DiskImages.framework/Versions/A/Resources/diskimages-helper
TCC_FDA /System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
TCC_Manager /System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
TCC_Manager /System/Library/PrivateFrameworks/CloudKitDaemon.framework/Support/cloudd
TCC_FDA /System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistant_service
TCC_Manager /System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistant_service
TCC_Manager /System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
TCC_FDA /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeassetd
TCC_Manager /System/Library/PrivateFrameworks/BookKit.framework/Versions/A/XPCServices/com.apple.BKAgentService.xpc/Contents/MacOS/com.apple.BKAgentService
TCC_Manager /System/Library/PrivateFrameworks/PhotoLibraryPrivate.framework/Versions/A/Support/photolibraryd
Rootless_Install /System/Library/PrivateFrameworks/StorageKit.framework/Versions/A/Resources/storagekitd
TCC_Manager /System/Library/PrivateFrameworks/SystemAdministration.framework/Versions/A/Resources/UpdateSettingsTool
TCC_FDA /System/Library/PrivateFrameworks/SystemAdministration.framework/XPCServices/writeconfig.xpc/Contents/MacOS/writeconfig
TCC_Manager /System/Library/PrivateFrameworks/SystemAdministration.framework/XPCServices/writeconfig.xpc/Contents/MacOS/writeconfig
TCC_Manager /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
TCC_Manager /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/XPCServices/ContainerMetadataExtractor.xpc/Contents/MacOS/ContainerMetadataExtractor
TCC_Manager /System/Library/PrivateFrameworks/SyncedDefaults.framework/Support/syncdefaultsd
TCC_Manager /System/Library/PrivateFrameworks/HomeKitDaemon.framework/Support/homed
TCC_AppleEvents /System/Library/Frameworks/SafariServices.framework/Versions/A/XPCServices/com.apple.SafariServices.ExtensionHelper.xpc/Contents/MacOS/com.apple.SafariServices.ExtensionHelper
TCC_Manager /System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/iOSScreenCapture.plugin/Contents/Resources/iOSScreenCaptureAssistant
TCC_Manager /System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/VDC.plugin/Contents/Resources/VDCAssistant
TCC_Manager /System/Library/Frameworks/MediaLibrary.framework/Versions/A/XPCServices/com.apple.MediaLibraryService.xpc/Contents/MacOS/com.apple.MediaLibraryService
TCC_Manager /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/corespotlightd
TCC_FDA /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdwrite
TCC_FDA /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdworker_shared
TCC_FDA /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdsync
TCC_FDA /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mds
TCC_FDA /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/com.apple.appkit.xpc.openAndSavePanelService.xpc/Contents/MacOS/com.apple.appkit.xpc.openAndSavePanelService
TCC_AppleEvents /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/com.apple.appkit.xpc.openAndSavePanelService.xpc/Contents/MacOS/com.apple.appkit.xpc.openAndSavePanelService
TCC_Manager /System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd
TCC_Manager /System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
TCC_PostEvent /System/Library/Input Methods/KeyboardViewer.app/Contents/MacOS/KeyboardViewer
TCC_PostEvent /System/Library/Input Methods/TrackpadIM.app/Contents/PlugIns/TIM_Extension.appex/Contents/MacOS/TIM_Extension
TCC_PostEvent /System/Library/Input Methods/50onPaletteServer.app/Contents/MacOS/50onPaletteServer
TCC_AppleEvents /System/Library/Input Methods/Assistive Control.app/Contents/MacOS/Assistive Control
Rootless_Install /System/Library/Filesystems/msdos.fs/Contents/Resources/msdos.util
Rootless_Install /System/Library/Filesystems/msdos.fs/Contents/Resources/mount_msdos
Rootless_Install /System/Library/Filesystems/msdos.fs/Contents/Resources/fsck_msdos
Rootless_Install /System/Library/Filesystems/hfs.fs/Contents/Resources/mount_hfs
Rootless_Install /System/Library/Filesystems/hfs.fs/Contents/Resources/hfs.util
Rootless_Install /System/Library/Filesystems/apfs.fs/Contents/Resources/apfs_invert
TCC_FDA /System/Library/InternetAccounts/internetAccountsMigrator
TCC_FDA /Applications/Utilities/System Information.app/Contents/MacOS/System Information
TCC_AppleEvents /Applications/Utilities/System Information.app/Contents/MacOS/System Information
TCC_PostEvent /Applications/Utilities/System Information.app/Contents/MacOS/System Information
TCC_AppleEvents /Applications/Utilities/Script Editor.app/Contents/MacOS/Script Editor