Mass SharePoint/OneDrive access via python-httpx user agent
Detects anomalous, high-volume file access and download activity targeting SharePoint or OneDrive. This behavior is identified by the use of the python-httpx User-Agent, which is often associated with automated scripts for data collection and exfiltration in cloud-based intrusions.
YARA-L
