{
  "metadata": {
    "generator": "Bulwark Black IOC Extractor",
    "source": "https://bulwarkblack.com/stolen-identity-cross-saas-vishing-response/",
    "fang": "live",
    "exported_at": "2026-10-20T15:04:11Z",
    "total": 6,
    "categories": 1
  },
  "iocs": {
    "URLs": [
      "https://graph.microsoft.com/beta/tenantRelationships/getResourceTenants?$select=tenantId",
      "https://graph.microsoft.com/v1.0/domains",
      "https://graph.microsoft.com/v1.0/me/licenseDetails",
      "https://graph.microsoft.com/v1.0/organization",
      "https://graph.microsoft.com/v1.0/sites",
      "https://graph.microsoft.com/v1.0/users/$count"
    ]
  }
}