Zoom Rare Input Devices Detection

This rule detects rare input devices (microphones) used during Zoom meetings. It specifically looks for microphone devices that are not commonly observed, while excluding typical devices like iPhones, FaceTimes, AirPods, and MacBooks. The primary goal is to identify unusual device usage that could be indicative of Remote Employment Fraud (REF), where actors might use non-standard equipment. This is a hunting query designed to flag anomalies for further investigation.