---
title: Suspicious Process Execution by Zoom
description: Identifies suspicious process execution associated with the Zoom desktop client on macOS and Linux. The rule detects shells, script interpreters, downloaders,...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/cross-platform/execution_suspicious_process_execution_by_zoom
products:
  - Elastic Security
---

# Suspicious Process Execution by Zoom
Identifies suspicious process execution associated with the Zoom desktop client on macOS and Linux. The rule detects
shells, script interpreters, downloaders, and network utilities spawned by Zoom on either platform. On Linux, it also
detects Zoom replacing its own process image with an executable outside the Zoom installation directory. These behaviors
may indicate successful exploitation of a Zoom client vulnerability, including CVE-2026-53413.
**Rule type**: eql
**Rule indices**:
- logs-endpoint.events.process-*

**Rule Severity**: high
**Risk Score**: 73
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://a.security/blog/asecurity-zoomsday](https://a.security/blog/asecurity-zoomsday)](https://a.security/blog/asecurity-zoomsday)
- [[https://www.zoom.com/en/trust/security-bulletin/zsb-26015/](https://www.zoom.com/en/trust/security-bulletin/zsb-26015/)](https://www.zoom.com/en/trust/security-bulletin/zsb-26015/)
- [[https://www.securityweek.com/zoom-patches-zero-click-code-execution-vulnerability/](https://www.securityweek.com/zoom-patches-zero-click-code-execution-vulnerability/)](https://www.securityweek.com/zoom-patches-zero-click-code-execution-vulnerability/)

**Tags**:
- Domain: Endpoint
- OS: Linux
- OS: macOS
- Use Case: Threat Detection
- Use Case: Vulnerability
- Tactic: Execution
- Data Source: Elastic Defend
- Rule Type: Event Correlation (EQL)
- Resources: Investigation Guide
- Platform: Linux
- Platform: macOS
- Domain: SaaS
- Data Source: Zoom
- Vuln: CVE-2026-53413

**Version**: 2
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Setup

This rule requires process events from Elastic Defend on macOS or Linux.
Elastic Defend is integrated into the Elastic Agent using Fleet. Configure the integration to collect process events
from protected endpoints. The Linux image-replacement branch requires `process.previous.executable`, which Elastic
Defend provides on Linux `exec` process events.

## Investigation guide


## Triage and analysis> **Disclaimer**:
This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Suspicious Process Execution by Zoom

CVE-2026-53413 is a buffer overwrite in Zoom's annotation parser that can allow a meeting participant to execute code
on another participant's device. The published macOS exploit replaced the running `zoom.us` process image with Safari
using `execvp`. Other payloads may instead spawn a shell, interpreter, downloader, or network utility. This rule detects
suspicious Zoom child processes on macOS and Linux and in-place Zoom process-image replacement on Linux, where Elastic
Defend records the prior image in `process.previous.executable`. The Linux logic identifies the Zoom executable
regardless of its installation path.

### Possible investigation steps

- Determine which branch matched. For a child process, verify that `process.parent.executable` is the genuine Zoom
  client. For Linux image replacement, compare `process.previous.executable` with `process.executable` and review the
  new image's path, hash, arguments, and provenance. The image-replacement branch excludes direct Zoom children because
  `process.previous.executable` includes the image inherited at fork as well as subsequent executions.
- Review the process command line and arguments for payload download, shell commands, persistence, credential access,
  discovery, or outbound connection activity.
- Use `process.entity_id` and `process.parent.entity_id` to examine related process, file, and network events before and
  after the alert. Look for additional payloads, persistence changes, credential access, and communication with
  untrusted destinations.
- Confirm the installed Zoom version and whether it was vulnerable at the alert time. Zoom Workplace releases before
  `7.1.5` and `7.0.6` in their respective branches are affected by CVE-2026-53413.
- Establish whether the user was in a Zoom meeting near the alert time. Preserve the meeting UUID and occurrence,
  participant report, client version, join and leave times, screen-sharing state, and available Zoom client logs.
- Review crash diagnostics for annotation-library faults or memory-corruption indicators near the alert. A crash alone
  is not sufficient evidence of exploitation.
- Check for other alerts on the host and for similar activity involving the same meeting participants or source
  infrastructure.


### False positive analysis

- Zoom may invoke legitimate support, diagnostic, accessibility, update, or enterprise-management tooling. Validate the
  binary's signature, path, command line, prevalence, and relationship to an approved workflow.
- Zoom performs Linux startup checks through a shell, including audio, graphics, desktop portal, and process-limit
  discovery. The known commands are excluded by this rule; investigate variations or additional chained commands.
- Opening authentication or meeting links normally uses an operating-system broker and should not require Zoom to spawn
  a shell or replace its own image. Treat direct shell, interpreter, or downloader execution as suspicious unless a
  specific benign workflow is confirmed.


### Response and remediation

- If exploitation is suspected, isolate the host and preserve process, file, network, crash, Zoom client, and meeting
  audit evidence before terminating processes or reimaging.
- Update Zoom to a fixed release and enforce minimum client versions. Until vulnerable clients are removed, disable
  end-to-end encryption so Zoom's server-side annotation filtering can inspect meeting content.
- Restrict meeting access with waiting rooms, passcodes, and authenticated-user requirements, and disable unnecessary
  annotation, whiteboarding, remote-control, file-transfer, and participant screen-sharing features.
- Remove malicious artifacts and persistence, rotate credentials accessible to the compromised user or process, and
  investigate other participants and endpoints associated with the meeting.


## Rule Query

```eql
process where event.type == "start" and event.action == "exec" and
  (
    (
      host.os.type == "linux" and
      process.previous.executable : "*/zoom" and
      not process.executable : "*/zoom" and
      not process.parent.name : "zoom"
    ) or
    (
      host.os.type in ("macos", "linux") and
      (
        (host.os.type == "macos" and
         process.parent.executable : "*/zoom.us.app/Contents/MacOS/zoom.us") or
        (host.os.type == "linux" and
         process.parent.name : "zoom")
      ) and
      process.name : (
        "sh", "bash", "zsh", "dash", "ksh", "fish", "ash", "mksh", "tsh", "tcsh", "pwsh",
        "python*", "perl*", "ruby*", "php*", "lua*", "node", "nodejs", "osascript",
        "curl", "nscurl", "wget", "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional",
        "nc.openbsd", "nc.traditional", "socat", "openssl",
        "chmod", "xattr"
      ) and
      not (
        host.os.type == "linux" and process.name in ("sh", "bash") and
        process.args : (
          "lspci",
          "pacmd --version",
          "pacmd list-sinks |grep 'name:\\|module:'",
          "pipewire --version",
          "ls /usr/share/xdg-desktop-portal/portals/",
          "/usr/libexec/xdg-desktop-portal --version",
          "cat /proc/sys/kernel/pid_max"
        )
      )
    )
  )
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Execution
  - Id: TA0002
  - Reference URL: [[https://attack.mitre.org/tactics/TA0002/](https://attack.mitre.org/tactics/TA0002/)](https://attack.mitre.org/tactics/TA0002/)
- Technique:
  - Name: Command and Scripting Interpreter
  - Id: T1059
  - Reference URL: [[https://attack.mitre.org/techniques/T1059/](https://attack.mitre.org/techniques/T1059/)](https://attack.mitre.org/techniques/T1059/)
- Sub Technique:
  - Name: AppleScript
  - Id: T1059.002
  - Reference URL: [[https://attack.mitre.org/techniques/T1059/002/](https://attack.mitre.org/techniques/T1059/002/)](https://attack.mitre.org/techniques/T1059/002/)
- Sub Technique:
  - Name: Unix Shell
  - Id: T1059.004
  - Reference URL: [[https://attack.mitre.org/techniques/T1059/004/](https://attack.mitre.org/techniques/T1059/004/)](https://attack.mitre.org/techniques/T1059/004/)
- Sub Technique:
  - Name: Python
  - Id: T1059.006
  - Reference URL: [[https://attack.mitre.org/techniques/T1059/006/](https://attack.mitre.org/techniques/T1059/006/)](https://attack.mitre.org/techniques/T1059/006/)
- Technique:
  - Name: Exploitation for Client Execution
  - Id: T1203
  - Reference URL: [[https://attack.mitre.org/techniques/T1203/](https://attack.mitre.org/techniques/T1203/)](https://attack.mitre.org/techniques/T1203/)