Microsoft Graph API Enumeration using GraphRunner GraphRecon
This rule detects the use of the GraphRunner tool's Invoke-GraphRecon command to enumerate permissions and conditional access data within the Microsoft Graph API. It specifically looks for a sequence of three API calls: 'estimateAccess', '/me', and 'policies/authorizationPolicy' originating from the same IP address and within a 5-minute window. This activity is indicative of an attacker or red teamer performing reconnaissance on an Azure AD environment.
YARA-L
