Identifies suspicious process execution related to the Zoom desktop client on macOS and Linux. The detection covers child processes spawned by Zoom (shells, script interpreters, downloaders, and network utilities) and, on Linux, Zoom process-image replacement where the running Zoom binary is replaced by another image outside the Zoom installation. This behavior aligns with exploitation patterns associated with CVE-2026-53413, and Elastic Defend logs prior process images to correlate with new executions. The rule uses process start events and analyzes the parent/previous executable, command line arguments, and path provenance to distinguish benign Zoom workflows from potentially malicious activity. It supports investigation steps that include verifying Zoom versions, examining process lineage, reviewing command-line payloads and outbound connections, and cross-referencing related alerts and Zoom meeting context. The rule is high-severity (risk_score 73) and is intended for endpoint protection on macOS and Linux endpoints. False positives may occur from legitimate maintenance or diagnostic workflows that trigger Zoom to launch command-line utilities. Remediation focuses on isolating the host, updating Zoom, enforcing secure configurations, and removing artifacts or persistence related to the incident.