Scripted Microsoft Graph API Recon Across Multiple Endpoints

Ibrahim Saud@tektrix

•updated 23 days ago•0•0•1

Detects individual process-level invocations of Microsoft Graph API endpoints commonly used for reconnaissance of user, group, and role information. This rule acts as a precursor signal to identify potential enumeration activities within an Office 365 environment.