Targeted mailbox search for payroll/HR/finance terms via Graph or eDiscovery

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•4

Detects specific, targeted search operations within M365 environments for keywords related to payroll, HR, and banking information. This behavior is indicative of post-compromise reconnaissance activity, often following AiTM (Adversary-in-the-Middle) session hijacking where an attacker attempts to locate financial documents and payroll correspondence.