Custom Graph API Filter Queries ($select, $top)

Ibrahim Saud@tektrix

•updated Jun 18, 2026•0•0•5

Detects specific URI patterns used by Storm-2949 to enumerate users, indicating automated directory reconnaissance. The rule specifically looks for Microsoft Graph API calls that include both '$select=displayName,userPrincipalName,jobTitle' and '$top=50' in the RawEventData, which are indicators of user enumeration.