Microsoft Graph User Endpoint Requests
This rule detects requests to the Microsoft Graph API's '/v1.0/users' endpoint with a GET method and a successful 200 response code. This API call is used to enumerate users within an Azure Active Directory environment. The rule is designed to identify potential reconnaissance activities where an attacker might be collecting a listing of users. It notes that this can be a 'chatty' API call, meaning it might generate a high volume of legitimate traffic.
YARA-L
