Payroll Pirate: Graph API Bulk User Enumeration with HR/Payroll Keyword Search
Detects anomalous automated enumeration of Microsoft Graph API user objects followed by keyword-based searches for sensitive HR, finance, and payroll-related information. This pattern is characteristic of post-compromise reconnaissance activities where an attacker leverages an existing session token to identify targets for further data exfiltration.
YARA-L
