ARToken-style automated Graph API mailbox scanning for BEC keywords

Ibrahim Saud@tektrix

•updated Sep 19, 2026•1•0•2

Detects high-frequency, automated polling of Microsoft 365 mailbox data via the Microsoft Graph API, characteristic of malicious inbox scanning tools (e.g., Box Monitor). The rule correlates these persistent access patterns with subsequent searches for high-value financial keywords, identifying potential Business Email Compromise (BEC) reconnaissance.