Automated SharePoint/Graph enumeration shortly after new sign-in
Detects high-volume, automated enumeration of cloud resources (SharePoint, OneDrive, or Exchange) via Graph API or search queries immediately following a user sign-in event. This behavior is indicative of session hijacking (token replay) followed by unauthorized scripted discovery, as opposed to legitimate user browsing activity.
YARA-L
