Multi-Category MS Graph API Reconnaissance from Single Identity/IP

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•1

This rule detects anomalous interaction with the Microsoft Graph API by monitoring for high-frequency requests across multiple functional categories (e.g., tenant, directory, privilege, application, repository, mailbox) from a single identity. A large number of distinct API paths across multiple categories in a short time frame is indicative of an attacker performing reconnaissance or automated environment enumeration.