Rapid multi-source connections to Microsoft auth/Graph endpoints (infra rotation

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•1

Detects high-frequency TLS sessions initiated from internal hosts to Microsoft identity, Graph API, and account management endpoints. This behavior often mimics legitimate interaction but may indicate an adversary rotating infrastructure, automating reconnaissance, or interacting with C2 channels disguised as legitimate SaaS traffic.