New domain added to Whitelist

id: 29752996-e85d-4905-a0e1-a7dcdfcda283
name: New domain added to Whitelist
description: |
  'This hunting query identifies new domains added to the domain login whitelist in Zoom.'
requiredDataConnectors: []
tactics:
  - Persistence
relevantTechniques:
  - T1098
query: |

  ZoomLogs 
  | where Event =~ "account.settings_updated"
  | extend NewDomains = columnifexists("payload_object_enforce_logon_domains", "")
  | where isnotempty(NewDomains)
  | project TimeGenerated, Event, User, NewDomains
  | extend timestamp = TimeGenerated, AccountCustomEntity = User
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
version: 1.0.0
metadata:
    source:
        kind: Community
    author:
        name: Pete Bryan
    support:
        tier: Community
    categories:
        domains: [ "Security - Other" ]