Microsoft Graph API Groups Endpoint Enumeration

Google SecOps@GoogleSecOps

•updated Feb 24, 2025•1•0•76

This rule detects GET requests to the Microsoft Graph API's '/v1.0/groups' endpoint. This activity can indicate an adversary enumerating groups within an Azure Active Directory environment, potentially using tools like GraphRunner's 'Get-DynamicGroups' function or similar custom scripts. Successful requests (HTTP 200) are specifically targeted.