Multi-Category Graph API Burst

Ibrahim Saud@tektrix

•updated Jun 18, 2026•0•0•6

Detects bursts of Microsoft Graph API calls hitting multiple distinct reconnaissance endpoints within a 60-second window. This behavior can indicate an adversary performing rapid enumeration or discovery within a Microsoft 365 environment.