Create Osquery query for TCC failures

OTRF / 2021-OceanLotus-workshop

MIT License

18 stars 4 forks source link

Open CptOfEvilMinions opened 2 years ago

CptOfEvilMinions commented 2 years ago

Sandbox: bash(918) System Policy: deny(1) file-read-data /Users/hton/Documents

Osquery query unified logs for TCC failures.