Bulk Graph API Enumeration of Mailbox To/From/CC/BCC Fields Across Folders

Smarth Arora@smarthxarora

•updated Jul 6, 2026•0•0•1

Detects Microsoft Graph API requests that perform bulk enumeration of email messages across multiple folders. The rule specifically identifies API queries that request sender (From) and recipient (To, CC, BCC) fields, a behavior consistent with mailbox address harvesting or reconnaissance by an Address Extractor module.