Payroll Pirate: axios/1.7.9 User-Agent in Microsoft Graph API Requests
Detects automated Microsoft Graph API requests originating from the 'axios/1.7.9' user-agent. This specific user-agent string is associated with the Payroll Pirate campaign, where threat actors (notably Storm-2755 and Storm-2657) employ scripted tools to enumerate directory information, specifically targeting HR and payroll personnel.
Microsoft Sentinel (KQL)
