Zoom E2E Encryption Disabled

Back


Id	e4779bdc-397a-4b71-be28-59e6a1e1d16b
Rulename	Zoom E2E Encryption Disabled
Description	This alerts when end to end encryption is disabled for Zoom meetings.
Severity	Medium
Tactics	CredentialAccess Discovery
Techniques	T1040
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ZoomLogs/E2EEDisbaled.yaml
Version	1.0.3
Arm template	e4779bdc-397a-4b71-be28-59e6a1e1d16b.json

KQL

ZoomLogs
| where Event =~ "account.settings_updated"
| extend NewE2ESetting = columnifexists("payload_object_settings_in_meeting_e2e_encryption_b", "")
| extend OldE2ESetting = columnifexists("payload_old_object_settings_in_meeting_e2e_encryption_b", "")
| where OldE2ESetting =~ 'false' and NewE2ESetting =~ 'true'
| extend AccountName = tostring(split(User, "@")[0]), AccountUPNSuffix = tostring(split(User, "@")[1])

YAML

triggerThreshold: 0
id: e4779bdc-397a-4b71-be28-59e6a1e1d16b
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ZoomLogs/E2EEDisbaled.yaml
description: |
    'This alerts when end to end encryption is disabled for Zoom meetings.'
query: |
  ZoomLogs
  | where Event =~ "account.settings_updated"
  | extend NewE2ESetting = columnifexists("payload_object_settings_in_meeting_e2e_encryption_b", "")
  | extend OldE2ESetting = columnifexists("payload_old_object_settings_in_meeting_e2e_encryption_b", "")
  | where OldE2ESetting =~ 'false' and NewE2ESetting =~ 'true'
  | extend AccountName = tostring(split(User, "@")[0]), AccountUPNSuffix = tostring(split(User, "@")[1])  
requiredDataConnectors: []
metadata:
  source:
    kind: Community
  categories:
    domains:
    - Security - Others
  support:
    tier: Community
  author:
    name: Microsoft Security Research
relevantTechniques:
- T1040
triggerOperator: gt
severity: Medium
name: Zoom E2E Encryption Disabled
version: 1.0.3
queryPeriod: 1d
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: User
    identifier: FullName
  - columnName: AccountName
    identifier: Name
  - columnName: AccountUPNSuffix
    identifier: UPNSuffix
queryFrequency: 1d
tactics:
- CredentialAccess
- Discovery
kind: Scheduled

ARM