Microsoft Graph calendarView query with fixed far-future 2050-05-13 C2 date window

Duo Tech@duotech

•updated Jul 21, 2026•1•0•9

Detects an HTTP GET request to the Microsoft Graph API (/v1.0/users/*/calendarView) containing a specific hardcoded far-future date (2050-05-13) in the startDateTime parameter. This pattern is indicative of a command-and-control (C2) mechanism leveraging a legitimate cloud service to maintain persistent communication channels.