Microsoft Graph API Mailbox Access for Top N Messages

Google SecOps@GoogleSecOps

•updated Feb 24, 2025•1•0•42

This rule identifies API requests made to the Microsoft Graph API to access user mailboxes and retrieve a specified number of messages. It specifically looks for GET requests to the `/v1.0/users/*/mailFolders/*/messages?$top=` endpoint with a successful HTTP 200 response. This activity could indicate an attacker attempting to exfiltrate emails from a compromised mailbox.