macOS Yara Rules

rule app_camera_mic_permissions {

meta:

description = "Application Requires Access to Camera and Microphone"

author = "RET"

reference = "https://objective-see.com/blog/blog_0x61.html"

date = "2022/01/18"

strings:

$s1 = /(NSCameraUsageDescription|NSMicrophoneUsageDescription)/ nocase

condition:

$s1

}