Video Conferencing App Spawning Shell - Social Engineering (T1566/T1204.002)

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•1

Detects instances where common video conferencing and collaboration applications (such as Microsoft Teams, Zoom, Webex, or Slack) initiate a command shell (cmd.exe, powershell.exe, or wscript.exe). This behavior is often indicative of social engineering or phishing attacks where an adversary executes malicious code via a meeting invite or chat message.