Graph payroll/HR enumeration followed by inbox rule creation

Ibrahim Saud@tektrix

•updated Sep 23, 2026•1•0•4

Detects potential account compromise by identifying a specific sequence of behavior: reconnaissance of sensitive users (HR/Payroll) via Microsoft Graph API calls, followed by the creation of inbox rules (e.g., forwarding) by the same user account within a 12-hour window.