Microsoft 365 Teams meeting join loop
One participant joining and leaving a Teams meeting repeatedly in a short window.
What it detects
One participant joining and leaving a Teams meeting repeatedly in a short window.
A person joins a meeting once. Repeated join/leave cycles in a couple of minutes is either a connection problem or someone probing how visible their presence is — dropping and rejoining to see whether a muted, camera-off guest gets challenged. On an executive or board call, that is eavesdropping with an audit trail.
Deliberately medium: bad wifi produces the same shape, and the log cannot tell the difference. What makes it interesting is the MEETING rather than the pattern, which is why the guidance points at who else was in the room.
MITRE ATT&CK mapping
False positives and triage
Unstable connections reconnect exactly like this, and on a large call several people will do it every day — this rule is noisy by nature and belongs in correlation rather than on its own. The discriminators are context, not count: whether the participant was an external or guest identity, whether the meeting was a leadership or deal call, and whether the same account shows other findings. A rejoin loop by a known internal user on a routine stand-up is a network problem and should be dismissed quickly.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 50%. Source: rules/cloud/m365_teams_meeting_join_loop.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_teams_meeting_join_loop
version: 1.0.0
status: stable
severity: medium
confidence: 0.5
platforms: [application]
mitre_techniques: [T1123, T1213]
description: |
One participant joining and leaving a Teams meeting repeatedly in a short window.
A person joins a meeting once. Repeated join/leave cycles in a couple of minutes
is either a connection problem or someone probing how visible their presence is —
dropping and rejoining to see whether a muted, camera-off guest gets challenged.
On an executive or board call, that is eavesdropping with an audit trail.
Deliberately medium: bad wifi produces the same shape, and the log cannot tell
the difference. What makes it interesting is the MEETING rather than the pattern,
which is why the guidance points at who else was in the room.
match:
provider: Office365
event_action_any:
- MeetingParticipantDetail
threshold:
count: 4
window_seconds: 120
group_by: [user_name]
correlation_keys: [user_name]
false_positive_guidance: |
Unstable connections reconnect exactly like this, and on a large call several
people will do it every day — this rule is noisy by nature and belongs in
correlation rather than on its own. The discriminators are context, not count:
whether the participant was an external or guest identity, whether the meeting
was a leadership or deal call, and whether the same account shows other findings.
A rejoin loop by a known internal user on a routine stand-up is a network problem
and should be dismissed quickly.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.