Azure AD Group Membership Enumerated via Graph API

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects when an attacker enumerates Azure AD group memberships via the Microsoft Graph API. It specifically looks for HTTP requests to 'graph.microsoft.com' with URI paths containing '/groups/' and '/members', indicating an attempt to list group members. A threshold is applied to detect a burst of such requests from a single source.