Zoom Windows client UNC path flaw
A vulnerability in Zoom's Windows client chat feature lets attackers steal credentials or run arbitrary executables via malicious hyperlinks.
IPA (Information-technology Promotion Agency, Japan) issued an alert regarding a vulnerability in the Windows client of Zoom, the video conferencing application. The flaw stems from improper handling of UNC (Universal Naming Convention) paths within the chat feature, allowing a malicious hyperlink crafted by an attacker to trigger credential theft or execution of arbitrary executable files when clicked by a victim.
The advisory warns that damage could expand if left unaddressed and urges users to apply vendor-provided patches promptly. IPA directs users to check version-specific remediation status via the linked vendor resources. No active exploitation is described in the article; this is a preventive advisory.
Mentioned in this report
Detection guidance
Zoom Client Spawning Process from UNC Path (Chat Link Exploitation)
Detects Zoom.exe launching a child process whose executable path or command line references a UNC (\\server\share) path, consistent with exploitation of the Zoom UNC path handling flaw when a user clicks a malicious chat link. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Zoom Client Child Process Executed From UNC Path
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \Zoom.exe
unc_path:
CommandLine|contains: \\\\
condition: selection and unc_path
falsepositives:
- Legitimate use of Zoom to open files or links stored on approved internal network
shares
- Corporate deployment scripts that reference UNC paths for shared resources
level: high
tags:
- attack.t1204.001
- attack.t1187
id: 4b58b340-be8f-525f-9969-f19306114488
status: experimental
author: Vorant
Zoom Process Initiating Outbound SMB Connection (Forced Authentication via UNC Link)
Detects Zoom.exe initiating an outbound SMB (port 445) connection, which can occur when a malicious UNC hyperlink in Zoom chat is clicked, forcing the victim's client to authenticate to an attacker-controlled host and leak NTLM credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Zoom Client Outbound SMB Connection to Remote Host
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: \Zoom.exe
DestinationPort: 445
filter:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter
falsepositives:
- Zoom transferring or opening files hosted on legitimate internal file shares
- VPN-connected clients whose internal ranges are not captured by the private-range
filter
level: medium
tags:
- attack.t1187
- attack.t1204.001
id: 786b2c3d-4c09-5388-8e3a-6ce1e64128ee
status: experimental
author: Vorant
Explorer or Command Shell Launched With UNC Path Argument Following Zoom Activity
Detects explorer.exe or a command interpreter being invoked with a UNC path argument shortly after user interaction with Zoom, indicative of a victim clicking a malicious chat hyperlink that triggers remote file/executable access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Explorer Or Shell Invoked With UNC Path Argument Near Zoom Activity
logsource:
category: process_creation
product: windows
detection:
selection_image:
Image|endswith:
- \explorer.exe
- \cmd.exe
- \powershell.exe
selection_unc:
CommandLine|contains: \\\\
parent_zoom:
ParentImage|endswith: \Zoom.exe
condition: selection_image and selection_unc and parent_zoom
falsepositives:
- Users legitimately opening shared drive links pasted into Zoom chat by colleagues
- IT support workflows that share UNC paths through chat for troubleshooting
level: medium
tags:
- attack.t1204.001
- attack.t1187
id: 361ec5c2-d47d-508b-868b-238973ae4678
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2020/alert20200403.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free