OAuth2 client-credentials auth accessing M365 mailbox calendarView via Graph API

Ethan Andrews@eandrews

•updated Jul 29, 2026•28•0•26

Detects Microsoft 365 service principals using application-only (client-credentials) authentication to access the Microsoft Graph API, specifically targeting the calendarView endpoint of user mailboxes. This behavior matches the HOLLOWGRAPH attack technique, which leverages M365 calendars as a covert command-and-control (C2) channel.