Microsoft Graph API User and Group Membership Enumeration
This rule detects the enumeration of both users and group members within an Entra ID (formerly Azure Active Directory) tenant via the Microsoft Graph API. It specifically looks for two distinct HTTP GET requests originating from the same IP address and within a 15-minute window: one targeting the `/v1.0/users` endpoint and another targeting the `/v1.0/groups/*/members` endpoint. This activity is often associated with reconnaissance efforts, such as those performed by tools like GraphRunner, to map out an organization's user and group structure.
YARA-L
