screensharingd or helper children accessing TCC-protected data without prior grant
Detects screensharingd or its child helper processes accessing TCC-protected data categories on hosts with no prior TCC grant recorded for screensharingd, indicating a TCC bypass via the Screen Sharing exploit chain.
Microsoft Sentinel (KQL)
