Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

TCC Bypass via Mounted APFS Snapshot Access

Identifies the use of the mount_apfs command to mount the entire file system through Apple File System (APFS) snapshots as read-only and with the noowners flag set. This action enables the adversary to access almost any file in the file system, including all user data and files protected by Apple’s privacy framework (TCC).

ATT&CK coverage

Outside the enterprise matrix

Detection requirements

Log source category: event_index

What the source says

References

https://theevilbit.github.io/posts/cve_2020_9771/

Tagged by the source as

Data Source: Elastic DefendDomain: EndpointOS: macOSResources: Investigation GuideTactic: Defense EvasionUse Case: Threat DetectionUse Case: Vulnerability

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.