Azurehound Graph Enumeration Overpermissioned Token

nomit vyas@xoxo

•updated Jun 25, 2026•2•0•16

Detects AzureHound or roadtx bulk enumeration of Microsoft Graph API endpoints using tokens obtained via CVE-2025-0309 CA policy bypass, characterized by high-frequency GET requests to /v1.0/users, /v1.0/groups, /v1.0/devices, /v1.0/servicePrincipals from Edge client IDs (f44b1140-bc5e-48c6-8dc0-5cf5a53c0e34 or 22098786-6e16-43cc-a27d-191a01a1e3b5) with password-only amr claim and no MFA.