Concentrated Graph API Mailbox Enumeration (Messages/Folders/Attachments)
Detects high-volume access to Microsoft Graph API endpoints related to messages, mail folders, and attachments by a single user account within a 30-minute window. This behavior is indicative of automated, unauthorized email and attachment scraping, often associated with remote email collection attempts.
Cortex XDR
