Mouse jiggler detection: a documentation review

The practical answer starts with what system produced a record. A coworker can notice a presence indicator without having endpoint-monitoring access. An administrator can have a usage report without having a complete record of mouse movement. Device-management and workforce-monitoring products add other capabilities when deployed.

The table classifies the evidence, not the employee. An inventory entry can support that software was recorded as installed; a running-process signal is a different observation. A pattern alert requires interpretation. None alone establishes the person's intent, the employer's rules, or the amount of useful work completed.

Microsoft describes Teams presence as a combination of user activity, app state, and Outlook calendar information. It is an availability signal. This definition does not say that Teams' green dot identifies the source of an input event or labels a mouse jiggler.

The Microsoft 365 User activity report documents message and meeting counts, calls, participation durations, last activity date, and an Other activity field. Its audio/video duration measures participation, not active speaking or continuous camera use. A quiet workday is therefore not equivalent to a report of no work.

The separate Device usage report concerns the kinds of clients people use to access Teams. Microsoft lists platform categories such as Windows, Mac, web, iOS, and Android. Despite its title, this is not a USB peripheral inventory. An administrator must use the relevant report and have the required access; the existence of a feature does not show that an individual manager routinely checks it.

Slack's availability guide says desktop inactivity and leaving the mobile app affect the dot. Its analytics definitions use a separate concept: a member's days active and last active are based on reading or sending messages in a channel or direct message. Messages posted is another distinct metric.

Slack says dashboard detail depends on the subscription, and member analytics access is controlled by owner settings and roles. The reviewed metric list does not turn a presence indicator into an all-day input record. Equally, that list cannot establish that an employer has no other monitoring outside Slack.

Intune's Windows app-inventory documentation describes collection of installed-application metadata, including name, version, publisher, and optional installation information. It requires Intune enrollment, Microsoft Entra joined Windows devices, and an assigned collection policy. The source also warns that not every property is available for every application.

Microsoft Defender for Endpoint separately documents basic connected-device auditing on onboarded endpoints, device properties, and Plug and Play connection events. Its walkthrough uses USB drives and other supported device-control scenarios. Those examples justify saying security products can collect connection evidence; they do not justify promising that every hardware jiggler will be uniquely identified.

This distinction also limits negative claims. Failure to see an app in one inventory view would not establish that no other security or monitoring system recorded a process, event, or unusual behavior. That is an inference about the evidence layers, not a test of a particular company's setup.

ActivTrak documents known-process identification, repetitive-pattern detection, and duration analysis. Its software signal can identify a running process without proving that process was actively simulating input. Repetitive-pattern coverage is Windows-only in the checked guide, and behavior depends on agent version. Alerts are investigation signals; they are not independent proof of intent.

Hubstaff's Insights documentation describes known simulation-app detection while tracking time and automated-input pattern flags. It says unusual activity can be legitimate and should be considered with other information. Screenshots are available only if captured and the viewer has permission. These statements describe deployed product capabilities, not an experiment confirming success against any specific device.

Ask which product, report, and observation support a claim. Installed software, a running process, a connected device, a repetitive pattern, and a green dot are separate statements with different evidential limits. Employer policy is another separate question; no visibility claim establishes approval to use a tool.

Idle Pilot prepared this as a source-linked document review checked October 28, 2026. Cite the specific vendor page alongside the relevant finding. We did not install jigglers, run detection trials, inspect employer systems, or compare ways to avoid monitoring. No result here makes a tool invisible or converts presence into a time sheet.