High-volume Microsoft Graph API tenant reconnaissance from single identity
This rule detects potential reconnaissance activity against Microsoft Graph API endpoints, indicative of an adversary enumerating tenant resources such as users, groups, applications, and directory roles. It monitors for high volumes of diverse Graph API queries originating from a single user or application identity within a short time window, which is a common behavior pattern for automated discovery tools.
Splunk (SPL)
