ARTSender Proxy Outbound Mail via Anomalous Graph API Client

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•2

Detects DNS resolutions for Microsoft Graph API endpoints (graph.microsoft.com) initiated by processes other than standard, expected Microsoft applications (e.g., Outlook, Teams, OneDrive). This behavior may indicate unauthorized processes or potential beaconing/C2 activity masquerading as legitimate Microsoft cloud service traffic.