Payroll Pirate: Graph API HR/Payroll Enumeration via Stolen Session Token
Detects automated enumeration patterns via the Microsoft Graph API, specifically targeting bulk directory pulls (requests with $top=999) and keyword-based searches for sensitive organizational data (payroll, HR, finance). This rule aggregates activity by user session to identify suspicious volumes and diversity of requests.
Splunk (SPL)
