Microsoft Graph API for Command and Control
Detects network connections to the Microsoft Graph API (graph.microsoft.com) from processes that are not common Microsoft Office applications. Threat actors, such as those behind the FINALDRAFT malware, have been observed using the Graph API for covert command and control (C2) communications, often by manipulating email drafts to send and receive commands. This allows them to blend their traffic with legitimate enterprise activity.
Sigma
