Endpoint DNS Resolution to Microsoft Graph API for Recon Support

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•2

Detects DNS resolution requests to 'graph.microsoft.com' on endpoint devices. This is intended to act as a precursor indicator for potential Microsoft 365 or Azure environment enumeration and discovery activities, which would typically involve subsequent API calls.