01
detectionlint / library / yara-l
ms_graph_groups_endpoint_requests
This detects when the groups endpoint is called in the Graph API. GraphRunner contains a function called Get-DynamicGroups but other tools may as well.
02
quality90
fp risk—
forks0
views0
rule sourcelocked
Sign in to view the rule source
Free accounts can view the source for the top-ranked rules. Create one in seconds — no credit card required.
Sign in