Graph API Recon: Tenant Relationships
Detects Graph API queries targeting getResourceTenants, identifying lateral movement preparation. This activity can be indicative of an adversary attempting to enumerate tenant relationships within Microsoft Graph to understand the environment and potentially identify targets for further compromise or lateral movement.
Microsoft Sentinel (KQL)
