Outlook Calendar Heartbeat Event Rotation via Microsoft Graph PATCH

Duo Tech@duotech

•updated Jul 21, 2026•3•0•6

Detects suspicious modifications or deletions of Outlook calendar events using the Microsoft Graph API, potentially indicating the use of calendar infrastructure as a command-and-control (C2) heartbeat or exfiltration channel. The rule monitors for specific pattern-based event updates or deletions following calendar enumeration, which is a technique used to maintain persistent communication or exfiltrate small amounts of data.