SharePoint/OneDrive Repository Discovery via Graph API Traversal

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•1

Detects high-frequency, diverse access patterns against the Microsoft Graph API, indicative of automated enumeration or discovery of SharePoint, OneDrive, or search resources. The rule monitors for distinct paths (e.g., sites, drives, children) requested by a single actor within a 20-minute window.