screensharingd Root Child Process Without TCC Consent Prompt
Detects a root-privileged child process of screensharingd with no corresponding TCC daemon activity on the host, indicating a TCC-bypassing privilege escalation via the pre-auth vulnerability.
Cortex XDR
