The Red Hands trailed by nine points at one stage to a Derry side which led 2-4 to 1-5 at the break, with goals from Benny Heron and Ryan Bell.
Patrick Quinn scored Tyrone's goal while Bell added a penalty before Derry's Emmet McGuckin was sent-off.
Tyrone piled on the points but Mark Craig's goal put Derry in front before two Connor McAliskey frees won it.
Derry were unable to halt the determined holders, who had a star performer in midfielder Richie Donnelly.
Media playback is not supported on this device
Heron was the first to find the net and points from Mark Craig, Bell and Mark Lynch eased the hosts further ahead, with the Red Hands losing centre back Justin McMahon to a black card.
Bell smashed home a penalty in the 23rd minute, but Tyrone hit back with a Quinn goal on the half-hour.
McAliskey and Johnny Munroe tagged on points, and at the break Derry led by two points.
Sean Cavanagh came off the bench to score a point before a Mark Bradley free gave Tyrone the lead.
Derry were awarded a second penalty in the 50th minute, which Bell again converted.
However, the loss of McGuckin to a second yellow card was an increasing problem for Damian Barton's side, and Tyrone struck a series of scores through Peter Harte, Richie Donnelly and David Mulgrew.
Derry's fourth goal came from Craig five minutes from the end, but the visitors responded with a couple of McAliskey frees to win by the narrowest of margins.
Bank of Ireland Dr McKenna Cup results
Saturday 9 January
Section C
Cavan 3-14 0-9 Ulster University
Sunday 10 January
Section A
Derry 4-6 1-16 Tyrone
Section B
Donegal 0-8 2-6 St Mary's College
Down 0-8 0-14 Fermanagh
Section C
Monaghan 2-9 0-16 Armagh

The men were located on Thursday on the remote Pacific island of Fanadik in Micronesia.
US Navy officials said they had been stranded for three days.
The crew aboard a US Navy plane, dispatched after the men were reported missing, spotted them around two hours into their search.
As well as the sign, the men were waving brightly-coloured lifejackets to attract attention.
The men said their vessel capsized due to a large wave a few hours after their departure from Pulap in the Federated States of Micronesia on Monday.
They say they spent the night swimming until they arrived on the island.
"Our combined efforts coupled with the willingness of many different resources to come together and help, led to the successful rescue of these three men in a very remote part of the Pacific," said Lt William White.

One server was stolen from a branch in Lurgan, County Armagh, in April 2014 and another was lost a month later by a courier firm in Swindon, Wiltshire.
Encryption systems were not good enough to ensure data could not be accessed, the Information Commissioner said.
The company apologised and said it had since reviewed its IT security.
The Information Commissioner's office said the servers, which are still missing, "held large numbers of local and national customer records and employee details".
Under The Money Shop's own rules, servers should have been stored in a separate locked room, but the Lurgan store - and others - did not have rooms available to store them.
It also had a "widespread practice" of moving unencrypted servers between its head office in Nottingham and its branches, the commissioner said. Old customer records were not deleted.
Head of enforcement at the commissioner's office, Steve Eckersley said customers had expected their financial details to be kept safe.
"Our investigations discovered that this wasn't the case and that this information was regularly left exposed when equipment was moved around the country.
"There was potential for fraud and financial loss to customers, which is unacceptable, and in both cases had the data been properly encrypted the damage and distress to customers and the monetary penalty could have been avoided."
Dollar UK, which owns the Money Shop, said: "Since these events took place, Dollar UK has come under new ownership and management, implementing a complete review of IT and systems security, including the replacement of those responsible for managing this essential element of business infrastructure and consumer confidence."
Tyrone fought back to clinch a 1-16 to 4-6 victory over Derry in a dramatic Dr McKenna Cup encounter at Owenbeg.
[NEXT_CONCEPT]
Three sailors have been rescued from an uninhabited Pacific island by the US Navy after spelling out "help" with palm fronds.
[NEXT_CONCEPT]
Payday lender The Money Shop has been fined £180,000 after losing computer servers with thousands of customers' financial details.