Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
5
3
Contributors
8
Categories
3
2
2
2
1
Platforms
8
5
5
Products / Services
10,371
9,516
6,509
4,371
3,687
MITRE Techniques
6
6
1
1
1
CVEs
5
4
4
IDS Classtypes
3
IDS Protocols
2
1
Detects a Zoom process (zoom.us/zoom.exe/CptHost.exe) writing to the Windows camera/microphone/screen-capture consent-store registry keys while no meeting network activity occurred within 15 minutes before or after, excluding pre-meeting device checks from Zoom Settings — a potential post-exploitation surveillance indicator following ZOOMSDAY RCE.
Flags Zoom Workplace, VDI Client for Windows, and Zoom Rooms processes running a version below the ZOOMSDAY-patched thresholds (7.1.5/7.0.6 Workplace, 7.0.11/6.6.16 VDI, 7.1.0 Rooms/SDK), using semantic major.minor.patch comparison per product line so versions are never compared against the wrong product's threshold.
Suricata signature detecting a Zoom annotation CAnnoFormatBlock/CAnnoTextFrame/CAnnoTextRange PDU where a count field (count1-4) precisely exceeds 64, overflowing the 128-byte destination buffer — the wire-level trigger for the ZOOMSDAY buffer overflow, stack overflow, and heap-disclosure primitives (CVE-2026-53413).
Detects a Zoom client (zoom.exe/CptHost.exe) crashing or spawning an unexpected non-Zoom child process with an access-violation/stack-corruption/heap-overflow signature within 10 seconds of annotation-channel network activity, indicating attempted or successful exploitation of the ZOOMSDAY zero-click annotation RCE (CVE-2026-53413). Excludes known Zoom updater, crash-reporter, and screen-share helper processes.
Suricata signature chain detecting a burst of 20+ 592-byte ExtChild AddObj annotation messages from a single source within 5 seconds (heap-spray pattern), followed by a RemoveObj/ModifyObj teardown operation consistent with dispatch through a corrupted vtable pointer — the full CVE-2026-53414 heap overflow and control-flow hijack chain.
Suricata signature for a Zoom annotation PDU carrying opcode 0x10001 (AddObj) delivered on the downstream acknowledgement channel (which should only carry 0x10002/AddObjAck), indicating sender-role/opcode confusion that lets any participant forge presenter-privileged annotation objects (ZOOMSDAY, CVE-2026-53413/53414/53415).
Correlates end-to-end encryption (E2EE) enablement events with either an absence of expected server-side annotation-filter log entries or a malformed annotation payload indicator (CAnnoFormatBlock/CAnnoTextFrame/CAnnoTextRange/CAnnoExtBlock/CAnnoPduAddObj fields) within the same 15-minute window, surfacing meetings where Zoom's server-side ZOOMSDAY mitigation could not inspect traffic.
Detects a Zoom client (zoom.exe/zoom.us/CptHost.exe) terminating abnormally (SIGABRT/SIGSEGV/stack corruption) from within the annotation module (libannotate.so) within 30 seconds of receiving a message-type-75 (CAnnoObjAutoMetaShape) annotation object, indicating exploitation of the linked-list unlink write-what-where primitive (CVE-2026-53415). Excludes update-triggered restarts and graceful shutdowns.