Suspicious User-Agent Activity in Microsoft Graph Logs

Information hacker@Informationhacker

•updated Feb 10, 2026•35•0•413

This rule detects suspicious user-agent strings in Microsoft Graph activity logs that are commonly associated with reconnaissance and attack tools targeting Azure AD and Microsoft 365 environments. These tools include BloodHound, ROADtools, AADInternals, and various other utilities used for enumeration, credential spraying, and other malicious activities.