Storm-2372 Azure AD Graph API Bulk Directory Enumeration Post Device Registration
Detects bulk reconnaissance against multiple Microsoft Graph API endpoints (users, groups, roles, etc.) by scripting clients, correlated with a recent device registration event by the same user principal. This behavior is indicative of a Storm-2372 conditional access bypass strategy followed by rapid directory environment enumeration.
YARA-L
