InformationalSplunk security content Marissa Bower +1

Zoom High Video Latency

Detects particularly high latency from Zoom logs. Latency observed from threat actors performing Remote Employment Fraud (REF) is typically well above what’s normal for the majority of employees.

Detection logic

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite SaaS Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.

Known benign triggers

While latency could simply indicate a slow network connection, when combined with other indicators, it can help build a more complete picture. Tune the threshold as needed for your environment baseline.

Detection rules

Zoom High Video Latency

Detection logic

Detection requirements

Known benign triggers

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules