Zscaler ZDX - Sustained Abnormal CPU/Memory Utilization (Possible Resource-Abuse Malware)

KQL Cowboy@KQLCowboy

•updated Aug 18, 2026•0•0•2

Detects devices exhibiting sustained high CPU or memory utilization (>= 90%) for a duration of at least 30 minutes, which may indicate resource exhaustion, performance degradation, or potentially malicious activity such as cryptocurrency mining, denial-of-service, or other unauthorized resource-intensive processes.