Automated Graph API Reconnaissance (T1087.004)
Detects rapid, automated enumeration of Azure AD users, groups, and directory roles via the Microsoft Graph API immediately post-compromise. This rule identifies a high volume of queries (more than 50 within a 5-minute window) originating from a single account and IP address, targeting either 'Microsoft Graph' as the application or 'SearchQueryPerformed' as the action type.
Microsoft Sentinel (KQL)
