Suspicious Process Execution by Zoom

  1[metadata]
  2creation_date = "2026/08/12"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/08/20"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies suspicious process execution associated with the Zoom desktop client on macOS and Linux. The rule detects
 11shells, script interpreters, downloaders, and network utilities spawned by Zoom on either platform. On Linux, it also
 12detects Zoom replacing its own process image with an executable outside the Zoom installation directory. These behaviors
 13may indicate successful exploitation of a Zoom client vulnerability, including CVE-2026-53413.
 14"""
 15false_positives = [
 16    """
 17    Legitimate support, diagnostic, accessibility, update, or enterprise management workflows may cause Zoom to launch
 18    command-line utilities. Verify the executable path, command line, code signature, and surrounding user activity
 19    before adding exceptions.
 20    """,
 21]
 22from = "now-9m"
 23index = ["logs-endpoint.events.process-*"]
 24language = "eql"
 25license = "Elastic License v2"
 26name = "Suspicious Process Execution by Zoom"
 27note = """## Triage and analysis
 28
 29> **Disclaimer**:
 30> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 31
 32### Investigating Suspicious Process Execution by Zoom
 33
 34CVE-2026-53413 is a buffer overwrite in Zoom's annotation parser that can allow a meeting participant to execute code
 35on another participant's device. The published macOS exploit replaced the running `zoom.us` process image with Safari
 36using `execvp`. Other payloads may instead spawn a shell, interpreter, downloader, or network utility. This rule detects
 37suspicious Zoom child processes on macOS and Linux and in-place Zoom process-image replacement on Linux, where Elastic
 38Defend records the prior image in `process.previous.executable`. The Linux logic identifies the Zoom executable
 39regardless of its installation path.
 40
 41### Possible investigation steps
 42
 43- Determine which branch matched. For a child process, verify that `process.parent.executable` is the genuine Zoom
 44  client. For Linux image replacement, compare `process.previous.executable` with `process.executable` and review the
 45  new image's path, hash, arguments, and provenance. The image-replacement branch excludes direct Zoom children because
 46  `process.previous.executable` includes the image inherited at fork as well as subsequent executions.
 47- Review the process command line and arguments for payload download, shell commands, persistence, credential access,
 48  discovery, or outbound connection activity.
 49- Use `process.entity_id` and `process.parent.entity_id` to examine related process, file, and network events before and
 50  after the alert. Look for additional payloads, persistence changes, credential access, and communication with
 51  untrusted destinations.
 52- Confirm the installed Zoom version and whether it was vulnerable at the alert time. Zoom Workplace releases before
 53  `7.1.5` and `7.0.6` in their respective branches are affected by CVE-2026-53413.
 54- Establish whether the user was in a Zoom meeting near the alert time. Preserve the meeting UUID and occurrence,
 55  participant report, client version, join and leave times, screen-sharing state, and available Zoom client logs.
 56- Review crash diagnostics for annotation-library faults or memory-corruption indicators near the alert. A crash alone
 57  is not sufficient evidence of exploitation.
 58- Check for other alerts on the host and for similar activity involving the same meeting participants or source
 59  infrastructure.
 60
 61### False positive analysis
 62
 63- Zoom may invoke legitimate support, diagnostic, accessibility, update, or enterprise-management tooling. Validate the
 64  binary's signature, path, command line, prevalence, and relationship to an approved workflow.
 65- Zoom performs Linux startup checks through a shell, including audio, graphics, desktop portal, and process-limit
 66  discovery. The known commands are excluded by this rule; investigate variations or additional chained commands.
 67- Opening authentication or meeting links normally uses an operating-system broker and should not require Zoom to spawn
 68  a shell or replace its own image. Treat direct shell, interpreter, or downloader execution as suspicious unless a
 69  specific benign workflow is confirmed.
 70
 71### Response and remediation
 72
 73- If exploitation is suspected, isolate the host and preserve process, file, network, crash, Zoom client, and meeting
 74  audit evidence before terminating processes or reimaging.
 75- Update Zoom to a fixed release and enforce minimum client versions. Until vulnerable clients are removed, disable
 76  end-to-end encryption so Zoom's server-side annotation filtering can inspect meeting content.
 77- Restrict meeting access with waiting rooms, passcodes, and authenticated-user requirements, and disable unnecessary
 78  annotation, whiteboarding, remote-control, file-transfer, and participant screen-sharing features.
 79- Remove malicious artifacts and persistence, rotate credentials accessible to the compromised user or process, and
 80  investigate other participants and endpoints associated with the meeting.
 81"""
 82references = [
 83    "https://a.security/blog/asecurity-zoomsday",
 84    "https://www.zoom.com/en/trust/security-bulletin/zsb-26015/",
 85    "https://www.securityweek.com/zoom-patches-zero-click-code-execution-vulnerability/",
 86]
 87risk_score = 73
 88rule_id = "84b81b96-58dd-4c0d-9b2e-35023ab5ee88"
 89setup = """## Setup
 90
 91This rule requires process events from Elastic Defend on macOS or Linux.
 92
 93Elastic Defend is integrated into the Elastic Agent using Fleet. Configure the integration to collect process events
 94from protected endpoints. The Linux image-replacement branch requires `process.previous.executable`, which Elastic
 95Defend provides on Linux `exec` process events.
 96"""
 97severity = "high"
 98tags = [
 99    "Domain: Endpoint",
100    "OS: Linux",
101    "OS: macOS",
102    "Use Case: Threat Detection",
103    "Use Case: Vulnerability",
104    "Tactic: Execution",
105    "Data Source: Elastic Defend",
106    "Rule Type: Event Correlation (EQL)",
107    "Resources: Investigation Guide",
108]
109timestamp_override = "event.ingested"
110type = "eql"
111
112query = '''
113process where event.type == "start" and event.action == "exec" and
114  (
115    (
116      host.os.type == "linux" and
117      process.previous.executable : "*/zoom" and
118      not process.executable : "*/zoom" and
119      not process.parent.name : "zoom"
120    ) or
121    (
122      host.os.type in ("macos", "linux") and
123      (
124        (host.os.type == "macos" and
125         process.parent.executable : "*/zoom.us.app/Contents/MacOS/zoom.us") or
126        (host.os.type == "linux" and
127         process.parent.name : "zoom")
128      ) and
129      process.name : (
130        "sh", "bash", "zsh", "dash", "ksh", "fish", "ash", "mksh", "tsh", "tcsh", "pwsh",
131        "python*", "perl*", "ruby*", "php*", "lua*", "node", "nodejs", "osascript",
132        "curl", "nscurl", "wget", "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional",
133        "nc.openbsd", "nc.traditional", "socat", "openssl",
134        "chmod", "xattr"
135      ) and
136      not (
137        host.os.type == "linux" and process.name in ("sh", "bash") and
138        process.args : (
139          "lspci",
140          "pacmd --version",
141          "pacmd list-sinks |grep 'name:\\|module:'",
142          "pipewire --version",
143          "ls /usr/share/xdg-desktop-portal/portals/",
144          "/usr/libexec/xdg-desktop-portal --version",
145          "cat /proc/sys/kernel/pid_max"
146        )
147      )
148    )
149  )
150'''
151
152
153[[rule.threat]]
154framework = "MITRE ATT&CK"
155[[rule.threat.technique]]
156id = "T1059"
157name = "Command and Scripting Interpreter"
158reference = "https://attack.mitre.org/techniques/T1059/"
159[[rule.threat.technique.subtechnique]]
160id = "T1059.002"
161name = "AppleScript"
162reference = "https://attack.mitre.org/techniques/T1059/002/"
163
164[[rule.threat.technique.subtechnique]]
165id = "T1059.004"
166name = "Unix Shell"
167reference = "https://attack.mitre.org/techniques/T1059/004/"
168
169[[rule.threat.technique.subtechnique]]
170id = "T1059.006"
171name = "Python"
172reference = "https://attack.mitre.org/techniques/T1059/006/"
173
174
175[[rule.threat.technique]]
176id = "T1203"
177name = "Exploitation for Client Execution"
178reference = "https://attack.mitre.org/techniques/T1203/"
179
180
181[rule.threat.tactic]
182id = "TA0002"
183name = "Execution"
184reference = "https://attack.mitre.org/tactics/TA0002/"