Graph API privilege, MFA, and consent discovery reconnaissance
This rule detects potential reconnaissance activity within a Microsoft Entra ID (Azure AD) environment by monitoring Microsoft Graph API audit logs. It specifically flags accounts that exhibit high-frequency access to sensitive endpoints related to directory roles, role management, authentication methods, service principals, and application permissions. The detection triggers when an identity interacts with multiple distinct sensitive API paths within a 30-minute window, a pattern indicative of an adversary enumerating privileges, MFA configurations, or application consent settings for potential escalation or persistence.
Splunk (SPL)
