Hunt for search/query endpoint API requests in the Microsoft Graph

Google SecOps@GoogleSecOps

•updated Feb 24, 2025•0•0•0

This detects when the search/query endpoint is called which can be used for enumeration of items like SharePoint site URLs. GraphRunner contains a function called Get-SharePointSiteURLs but other tools may as well.