Zoom E2E Encryption Disabled

Back


Id	e4779bdc-397a-4b71-be28-59e6a1e1d16b
Rulename	Zoom E2E Encryption Disabled
Description	This alerts when end to end encryption is disabled for Zoom meetings.
Severity	Medium
Tactics	CredentialAccess Discovery
Techniques	T1040
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ZoomLogs/E2EEDisbaled.yaml
Version	1.0.3
Arm template	e4779bdc-397a-4b71-be28-59e6a1e1d16b.json

KQL

ZoomLogs
| where Event =~ "account.settings_updated"
| extend NewE2ESetting = columnifexists("payload_object_settings_in_meeting_e2e_encryption_b", "")
| extend OldE2ESetting = columnifexists("payload_old_object_settings_in_meeting_e2e_encryption_b", "")
| where OldE2ESetting =~ 'false' and NewE2ESetting =~ 'true'
| extend AccountName = tostring(split(User, "@")[0]), AccountUPNSuffix = tostring(split(User, "@")[1])

YAML

queryFrequency: 1d
tactics:
- CredentialAccess
- Discovery
name: Zoom E2E Encryption Disabled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ZoomLogs/E2EEDisbaled.yaml
triggerThreshold: 0
description: |
    'This alerts when end to end encryption is disabled for Zoom meetings.'
kind: Scheduled
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: User
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: AccountUPNSuffix
metadata:
  source:
    kind: Community
  support:
    tier: Community
  categories:
    domains:
    - Security - Others
  author:
    name: Microsoft Security Research
id: e4779bdc-397a-4b71-be28-59e6a1e1d16b
queryPeriod: 1d
version: 1.0.3
severity: Medium
relevantTechniques:
- T1040
requiredDataConnectors: []
triggerOperator: gt
query: |
  ZoomLogs
  | where Event =~ "account.settings_updated"
  | extend NewE2ESetting = columnifexists("payload_object_settings_in_meeting_e2e_encryption_b", "")
  | extend OldE2ESetting = columnifexists("payload_old_object_settings_in_meeting_e2e_encryption_b", "")
  | where OldE2ESetting =~ 'false' and NewE2ESetting =~ 'true'
  | extend AccountName = tostring(split(User, "@")[0]), AccountUPNSuffix = tostring(split(User, "@")[1])

ARM