Non-mail-client process resolving Graph API for mailbox enumeration

Ibrahim Saud@tektrix

•updated 23 days ago•0•0•1

Detects DNS resolution attempts for graph.microsoft.com by processes other than standard web browsers or mail clients. This activity is indicative of scripted tools or malicious software attempting to enumerate or access Microsoft 365 mailbox content via the Graph API, bypassing normal user interaction.