Mac Unauthorized Access Forensics

← Canonical HubThis page is part of the Mac Forensics cluster. Return to the hub for the full artifact index and cross-cluster context.

Quick Answer. Mac Unauthorized Access Forensics answers “did someone else use, monitor, or compromise this Mac” by systematically reviewing every persistence surface (LaunchAgents, LaunchDaemons, login items, cron, at, periodic, kext, SystemExtensions), every privacy grant (TCC.db), every code-signing decision (syspolicy, XProtect, MRT), and every remote-access footprint — cross-referenced with a Mac forensic timeline.

Every persistence location we always check

Mechanism	Location	Evidence recorded
LaunchAgents (user)	~/Library/LaunchAgents/*.plist	Per-user auto-start; runs on login
LaunchAgents (system)	/Library/LaunchAgents/*.plist	All-user auto-start
LaunchAgents (Apple)	/System/Library/LaunchAgents/*.plist	System-provided; changes here are highly suspect
LaunchDaemons (system)	/Library/LaunchDaemons/*.plist	Runs as root at boot
LaunchDaemons (Apple)	/System/Library/LaunchDaemons/*.plist	System-provided
Login Items	~/Library/Application Support/com.apple.backgroundtaskmanagement/BackgroundItems.btm	GUI login items and modern background tasks
cron	/private/var/at/tabs/	Per-user cron entries
at / periodic	/private/var/at/, /etc/periodic/	One-shot and periodic scripts
LoginHook / LogoutHook	com.apple.loginwindow.plist	Legacy but still respected
SystemExtensions	/Library/SystemExtensions/db.plist	Endpoint Security / network / DriverKit extensions
Kernel extensions	/Library/Extensions/, kmutil showloaded	Legacy kexts (require reboot to load)
Configuration Profiles	/Library/Managed Preferences/, profiles list	MDM-pushed policy — covert monitoring vector
Sudoers	/etc/sudoers, /etc/sudoers.d/	Elevated command surface

TCC grants — the covert monitoring smoking gun

Nearly every credible covert-monitoring tool on modern macOS requires the target user to grant Screen Recording, Accessibility, Input Monitoring, or Full Disk Access in System Settings. Each grant is recorded in ~/Library/Application Support/com.apple.TCC/TCC.db (per-user) or /Library/Application Support/com.apple.TCC/TCC.db (system) with:

• client — bundle ID of the granted app
• service — kTCCServiceScreenCapture, kTCCServiceAccessibility, kTCCServiceListenEvent, etc.
• allowed and prompt_count
• last_modified — when the grant was made

An unexplained Screen Recording or Accessibility grant to an app the user does not recognize — especially one installed from outside the App Store — is a decisive indicator. We review every non-Apple TCC row in every matter of suspected covert monitoring.

Known monitoring / spouseware families we inventory

Without naming specific commercial tools on this public page, we systematically check for the persistence-file names, bundle IDs, launch-agent labels, and network endpoints publicly documented by security researchers and by Apple’s own XProtect and MRT (Malware Removal Tool) signature updates. Where present, we preserve the binaries and their configuration for chain-of-custody handoff to counsel or law enforcement.

Living-off-the-land on macOS

Attackers increasingly avoid custom binaries. In every intrusion matter we review execution of:

• osascript — AppleScript invocations, often loaded with base64-encoded payloads
• curl, python3, ruby — download-and-execute patterns
• launchctl load — LaunchAgent registration events in com.apple.launchd
• sqlite3 — reads of TCC.db or Safari History.db by non-Apple processes
• xattr -c or xattr -d com.apple.quarantine — evasion of Gatekeeper
• plutil / defaults write — silent modification of preferences and LaunchAgents

Ruling in vs ruling out

Many matters end defense-favorably: no unauthorized LaunchAgents outside Apple defaults, no non-Apple TCC grants of significance, no unknown SystemExtensions, no unexplained network connections in the Unified Log, no XProtect / MRT signatures triggered, and shell / KnowledgeC.db activity fully consistent with the account holder. In those cases the report enumerates the surfaces reviewed, the negatives found, and the confidence bound on the conclusion. See the Mac Forensics hub for the full framework.

How Elite Digital Forensics helps

Elite Digital Forensics is an independent, defense-aligned Mac forensics practice. We are retained by attorneys, in-house counsel, and, where appropriate, individuals and businesses directly. Every engagement begins with a scoped acquisition plan, hash-verified evidence, and a written report suitable for attorney review, negotiation, or court. When retained through counsel, our work product is protected. See the Mac Forensics hub for the full analytical framework we bring to every matter.

Related Mac forensics pages

Frequently asked questions