Undocumented Microsoft Graph API 'Estimate Access' Call Detection
This rule detects calls to the undocumented 'Estimate Access' API in Microsoft Graph. This API is used by tools like GraphRunner for reconnaissance purposes, specifically to determine what actions a user can perform. While not inherently malicious, its use can indicate an adversary attempting to enumerate permissions or discover accessible resources within an Azure environment. The rule filters for successful POST requests to the specific beta endpoint and excludes certain Microsoft IP ranges to reduce false positives.
YARA-L
