Rapid Microsoft Graph API Reconnaissance Burst
This rule identifies rapid, multi-category reconnaissance activity against the Microsoft Graph API. It specifically looks for bursts of 20 or more requests across 4 or more unique Graph API endpoints within a one-minute window, particularly when those requests include parameters like '$top=999', '$count=true', or target '/beta/' endpoints, which are indicative of attempts to extract maximum data or use less common API versions. This behavior is typified by threat actors like Tycoon 2FA operators.
Microsoft Sentinel (KQL)
