Graph API Recon: Mailbox Settings

Ibrahim Saud@tektrix

•updated Jun 18, 2026•0•0•7

Detects Tycoon 2FA operator recon assessing mailbox forwarding rules, auto-replies, and timezones. This KQL query identifies actions related to 'mailboxSettings' within 'Microsoft Graph' events, which can indicate an adversary enumerating user mailbox configurations.