Repeated Graph API calendar/events create-read cycles (C2 dead-drop abuse)

Ethan Andrews@eandrews

•updated Jul 29, 2026•16•0•21

This rule detects anomalous patterns of Microsoft Graph API activity involving the /calendar, /events, and /calendarView endpoints. It identifies application identities performing high-frequency create (POST/PATCH) and read (GET) operations within a short time window. This behavior is indicative of a compromised mailbox being used as a C2 dead-drop channel, where the calendar is used to exchange commands and results between the adversary and the compromised environment.