Detections

Explore public detection logic contributed by the community across SIEM and rule languages.

1 detection

Correlates end-to-end encryption (E2EE) enablement events with either an absence of expected server-side annotation-filter log entries or a malformed annotation payload indicator (CAnnoFormatBlock/CAnnoTextFrame/CAnnoTextRange/CAnnoExtBlock/CAnnoPduAddObj fields) within the same 15-minute window, surfacing meetings where Zoom's server-side ZOOMSDAY mitigation could not inspect traffic.
avatar
Duo Tech@duotech
avatar
Detections.ai Community
2 months ago
003