Name:Zoom Rare Audio Devices id:9fdbf709-4c46-4819-9fb6-98b2d72059ed version:3 date:None author:Marissa Bower, Raven Tait status:experimental type:Hunting Description:Detects rare audio devices from Zoom logs. Actors performing Remote Employment Fraud (REF) typically use unusual device information compared to a majority of employees. Detecting this activity requires careful analysis, regular review, and a thorough understanding of the audio and video devices commonly used within your environment. Data_source:
search:`zoom_index` speaker=* NOT (camera=*iPhone* OR camera="*FaceTime*" OR speaker="*AirPods*" OR camera="*MacBook*" OR microphone="*MacBook Pro Microphone*")
| rare speaker limit=50
| `zoom_rare_audio_devices_filter`
how_to_implement:The analytic leverages Zoom logs to be ingested using Splunk Connect for Zoom (https://splunkbase.splunk.com/app/4961) known_false_positives:This is a hunting query meant to identify rare audio devices. References: drilldown_searches:
: analytic_story:['Remote Employment Fraud']
