Python HTTP client exfiltration traffic to Microsoft Graph endpoint

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•0

Detects outbound network traffic from internal hosts to the Microsoft Graph API (graph.microsoft.com) originating from Python HTTP clients (requests or urllib libraries). This pattern can indicate automated data exfiltration from an internal environment to a cloud-based service, or the use of Microsoft Graph API for command and control purposes.