Graph API recon-to-exfil chain: discovery followed by content collection

Ibrahim Saud@tektrix

•updated Sep 18, 2026•3•0•2

This rule detects anomalous behavior where an identity performs multi-category discovery (e.g., users, groups, directory roles, applications) via Microsoft Graph API within a single session, followed by intensive collection of content (files, attachments, or messages). This sequence is indicative of an adversary performing reconnaissance to map an environment before moving to data exfiltration or theft.