Detection: Zoom High Video Latency

EXPERIMENTAL DETECTION

This detection status is set to experimental. The Splunk Threat Research team has not yet fully tested, simulated, or built comprehensive datasets for this detection. As such, this analytic is not officially supported. If you have any questions or concerns, please reach out to us at research@splunk.com.

Updated Date: 2025-06-02 ID: 6ad6b548-adfa-452c-aa77-9ff94877e832 Author: Marissa Bower, Raven Tait Type: Anomaly Product: Splunk Enterprise Security

Description

Detects particularly high latency from Zoom logs. Latency observed from threat actors performing Remote Employment Fraud (REF) is typically well above what’s normal for the majority of employees.

Search

 1`zoom_index` 
 2| spath "payload.object.participant.qos{}.type" 
 3| search "payload.object.participant.qos{}.type"=video_input 
 4| rename payload.object.participant.qos{}.details.avg_latency as avg_latency "payload.object.participant.qos{}.details.latency" as latency payload.object.participant.email as email 
 5| rex field=avg_latency "(?<average_latency>\d+) ms" 
 6| rex field=latency "(?<overall_latency>\d+) ms" 
 7| search email="*" 
 8| table email overall_latency latency avg_latency average_latency _raw 
 9| stats latest(overall_latency) as overall_latency by email _raw 
10| where overall_latency>300 
11| `zoom_high_video_latency_filter`

Data Source

No data sources specified for this detection.

Macros Used

Name	Value
zoom_index	`index=zoom`
zoom_high_video_latency_filter	`search *`

zoom_high_video_latency_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1078	Valid Accounts	Defense Evasion

Delivery

Exploitation

Installation

DE.AE

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Risk Event	True

This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.

Implementation

The analytic leverages Zoom logs to be ingested using Splunk Connect for Zoom (https://splunkbase.splunk.com/app/4961)

Known False Positives

While latency could simply indicate a slow network connection, when combined with other indicators, it can help build a more complete picture. Tune the threshold as needed for your environment baseline.

Associated Analytic Story

Remote Employment Fraud

Risk Based Analytics (RBA)

Risk Message:

Suspicious latency from $email$ in Zoom activity.

Risk Object	Risk Object Type	Risk Score	Threat Objects
email	user	39	No Threat Objects

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	Not Applicable	N/A	N/A	N/A
Unit	❌ Failing	N/A	`N/A`	`N/A`
Integration	❌ Failing	N/A	`N/A`	`N/A`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1