Scripted Python Graph API Access to graph.microsoft.com for Bulk Exfil

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•2

Detects DNS resolution requests for graph.microsoft.com initiated by a python interpreter (python.exe, python3.exe, or pythonw.exe). This activity may indicate a script or custom tool communicating with Microsoft Graph API, which is frequently used for data collection, exfiltration, or cloud service interaction in adversarial campaigns.