Suspicious Process Execution by Zoom

process where event.type == "start" and event.action == "exec" and
  (
    (
      host.os.type == "linux" and
      process.previous.executable : "*/zoom" and
      not process.executable : "*/zoom" and
      not process.parent.name : "zoom"
    ) or
    (
      host.os.type in ("macos", "linux") and
      (
        (host.os.type == "macos" and
         process.parent.executable : "*/zoom.us.app/Contents/MacOS/zoom.us") or
        (host.os.type == "linux" and
         process.parent.name : "zoom")
      ) and
      process.name : (
        "sh", "bash", "zsh", "dash", "ksh", "fish", "ash", "mksh", "tsh", "tcsh", "pwsh",
        "python*", "perl*", "ruby*", "php*", "lua*", "node", "nodejs", "osascript",
        "curl", "nscurl", "wget", "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional",
        "nc.openbsd", "nc.traditional", "socat", "openssl",
        "chmod", "xattr"
      ) and
      not (
        host.os.type == "linux" and process.name in ("sh", "bash") and
        process.args : (
          "lspci",
          "pacmd --version",
          "pacmd list-sinks
| grep 'name:\\
| module:'",
          "pipewire --version",
          "ls /usr/share/xdg-desktop-portal/portals/",
          "/usr/libexec/xdg-desktop-portal --version",
          "cat /proc/sys/kernel/pid_max"
        )
      )
    )
  )

False Positives

• ⚠ Legitimate support, diagnostic, accessibility, update, or enterprise management workflows may cause Zoom to launch command-line utilities. Verify the executable path, command line, code signature, and surrounding user activity before adding exceptions.