Microsoft Graph organization endpoint queried for tenant validation before C2 activation
Detects GET requests to the Microsoft Graph API 'organization' endpoint, often used by malicious tools to validate a tenant environment or gather metadata before initiating C2 communication or secondary stages of an attack.
Sigma
