Storm-2755 - Anomalous Search for HR Contacts (T1087.002)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•3

Detects a compromised account performing heavy Graph API searches for HR personnel to socially engineer IT/Helpdesk. Specifically, it looks for search queries containing terms like 'HR', 'Human Resources', or 'Payroll Manager'.