Techniques
Sample rules
Suspicious Process Execution by Zoom
- source: elastic
- technicques:
- T1059
- T1203
Description
Identifies suspicious process execution associated with the Zoom desktop client on macOS and Linux. The rule detects shells, script interpreters, downloaders, and network utilities spawned by Zoom on either platform. On Linux, it also detects Zoom replacing its own process image with an executable outside the Zoom installation directory. These behaviors may indicate successful exploitation of a Zoom client vulnerability, including CVE-2026-53413.
Detection logic
process where event.type == "start" and event.action == "exec" and
(
(
host.os.type == "linux" and
process.previous.executable : "*/zoom" and
not process.executable : "*/zoom" and
not process.parent.name : "zoom"
) or
(
host.os.type in ("macos", "linux") and
(
(host.os.type == "macos" and
process.parent.executable : "*/zoom.us.app/Contents/MacOS/zoom.us") or
(host.os.type == "linux" and
process.parent.name : "zoom")
) and
process.name : (
"sh", "bash", "zsh", "dash", "ksh", "fish", "ash", "mksh", "tsh", "tcsh", "pwsh",
"python*", "perl*", "ruby*", "php*", "lua*", "node", "nodejs", "osascript",
"curl", "nscurl", "wget", "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional",
"nc.openbsd", "nc.traditional", "socat", "openssl",
"chmod", "xattr"
) and
not (
host.os.type == "linux" and process.name in ("sh", "bash") and
process.args : (
"lspci",
"pacmd --version",
"pacmd list-sinks |grep 'name:\\|module:'",
"pipewire --version",
"ls /usr/share/xdg-desktop-portal/portals/",
"/usr/libexec/xdg-desktop-portal --version",
"cat /proc/sys/kernel/pid_max"
)
)
)
)