Microsoft Graph API Group Members Enumeration
This rule detects the enumeration of members within groups in Microsoft Entra ID (formerly Azure AD) via the Microsoft Graph API. Specifically, it looks for GET requests to the `/v1.0/groups/*/members` endpoint, which is indicative of an attempt to list group members. The rule's description notes that it is based on the behavior of the GraphRunner tool's `Get-SecurityGroups` function, suggesting it targets a specific method of enumeration.
YARA-L
