Impact

Successful exploitation of this vector can lead to unauthorized code execution with the permissions of the Zoom process, potentially resulting in full endpoint compromise, lateral movement, or data exfiltration. Because this detection identifies anomalous activity, it serves as an early indicator of potential intrusion rather than confirmation of breach, requiring timely investigation to distinguish between benign software updates/plugins and malicious activity.

Recommendation

Deploy the provided Sigma rule to your SIEM environment to monitor for unknown Zoom child processes. Ensure that Endpoint Detection and Response (EDR) telemetry is correctly mapped to the process_creation log source and that command-line logging is enabled to facilitate the inspection of arguments passed to child processes. Given the experimental nature of this detection, it is recommended to tune the alerts by reviewing initial baselines for common legitimate child processes and suppressing them accordingly. Use the identified suspicious process parent-child relationships to initiate threat hunting activities focused on verifying the legitimacy of the spawned process and its associated command-line arguments.