TCCING IS BELIEVING

Summary from the TLDR InfoSec newsletter

Apple has added a new feature called Endpoint Security events for TCC modifications in MacOS 15.4. Exposed with ES_EVENT_TYPE_NOTIFY_TCC_MODIFY flag, this feature allows security tools to detect and possibly override user decisions on granting access to protected resources. The events will provide information on when a TCC permission is granted or revoked, helping users monitor and control access to their system.