Extensive Microsoft Graph API Tenant Enumeration (Post-Compromise Recon)

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•4

Detects high-frequency, diverse Microsoft Graph API requests initiated by an identity, indicative of automated reconnaissance or enumeration of the cloud environment. The rule tracks requests across multiple categories such as organization settings, user/group identities, privilege information, application configurations, and resource access within a 30-minute window.