Virtual-Camera/Deepfake Driver Install Followed by Video-Conference Launch
Detects the installation or execution of virtual camera or synthetic media software followed shortly by the launch of common video conferencing applications on the same endpoint. This behavior may indicate an attempt to inject synthetic video feeds into meetings for impersonation or business email compromise (BEC) attacks.
Microsoft Sentinel (KQL)
