Payroll Pirate AiTM Bulk Graph API HR Personnel Enumeration
Detects automated Microsoft Graph API requests indicative of the 'Payroll Pirate' campaign, specifically targeting payroll and HR personnel after initial access via AiTM session token theft. The rule identifies two malicious patterns: bulk user directory harvesting using '?$top=999' and keyword-targeted enumeration (payroll, human, compensation) using OR-chained search queries and pagination markers ($skiptoken).
Sigma
