Graph API recon burst: rapid multi-endpoint enumeration post-compromise

Ankit Mehta@Secvyn

•updated Sep 11, 2026•1•0•2

Detects anomalous, high-frequency access to sensitive Microsoft Graph API endpoints by a single service principal or user identity. The rule flags identities that interact with five or more distinct categories of sensitive resources (e.g., users, groups, applications, sites) within a 30-minute window, suggesting automated reconnaissance or environment discovery.