Microsoft Graph API OAuth Abuse - Sensitive Endpoint Exfiltration from Rare Geo

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•4

Detects high-volume data access or exfiltration from Azure/Office 365 cloud environments via common scripting/automation user-agents. The rule monitors API requests to users, mail, drive, or files endpoints by non-standard clients (e.g., python, curl, Go) from previously unseen locations, calculating a risk score based on the number of endpoints accessed and the total data volume.