Office Add-in Loaded from Remote URL

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects when an Office Add-in is loaded from a remote URL, specifically targeting graph.microsoft.com. It looks for HTTP POST requests where the host is 'graph.microsoft.com' and the URI contains 'addIns'. This activity could indicate an attempt to establish persistence or execute malicious code via Office Add-ins.