Payroll Pirate: Microsoft Graph API Bulk User Enumeration for HR/Payroll

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•3

This rule monitors Microsoft Graph API audit logs for suspicious activity targeting user objects. It specifically detects attempts at bulk enumeration, use of pagination to circumvent limits, or searches using keywords associated with sensitive organizational data (e.g., payroll, finance, hr, admin).