What is causing "SecurityAgent wants to make changes" dialog at login?

[tk_mac]

Starting Yesterday, every time I login to my Mac (running Mojave) I immediately get the message "SecurityAgent wants to make changes. Enter an administrator's name and password to allow this." I did NOT install any new software recently, so this is suspicious. I have been clicking "Cancel" as I do not want to approve of something unknown. How might I find out why or what is triggering the system to ask for this permission? Is there any system log that would tell and what should I look for? How else might I find out.

Thanks

 

[Bigwaff]

Security Agent is part of Mac OS. Security Agent handles the UI for prompting user for password when other software wants additional privileges. The dialog should include the name of the software requesting the privileges. Review the contents of the dialog closely.

 

[tk_mac]

The dialog should include the name of the software requesting the privileges.

It literally says "SecurityAgent wants to make changes". No other process. See picture below.

Is there any system log that records what processes make requests of SecurityAgent? Is there any log that records the start and stop of every process that runs? And if these things are in larger logs, what do I look for to isolate these events? Any other way to diagnose this? (I already ran MalwareBytes and it found no Malware.)

 

[bogdanw]

That looks suspicious. Run KnockKnock to see what is started at login https://objective-see.org/products/knockknock.html

 

[Bigwaff]

Review your start up/login items in System Preferences. Are sure you don’t have any software configured to automatically install updates?