telemetry correlation

Telemetry correlation is a key technique for detecting advanced threats like Ghost Calls, which abuse Microsoft Teams and Zoom's TURN infrastructure to tunnel command-and-control traffic. By correlating telemetry from network logs, authentication events, and media relay usage, security teams can identify anomalies such as unexpected TURN credential reuse or traffic patterns that deviate from normal WebRTC flows. This approach helps uncover covert tunnels that bypass firewalls and TLS inspection by blending in with legitimate conference call traffic. Effective telemetry correlation requires integrating data from multiple sources to distinguish malicious activity from benign meeting behavior, enabling earlier detection of post-exploitation attacks that exploit trusted platform infrastructure.