Graph API Reconnaissance for Payroll/HR/Finance Users or Tenant-wide Enumeration

Ibrahim Saud@tektrix

•updated Sep 23, 2026•1•0•3

Detects reconnaissance activity targeting sensitive personnel groups (payroll, HR, finance) via Microsoft Graph API. The rule identifies suspicious URI patterns combined with the use of the 'axios' User-Agent library, potentially indicating automated enumeration by an adversary to map high-value targets for future business email compromise or credential theft.