High-volume SharePoint/OneDrive/Exchange collection via python-httpx

Ibrahim Saud@tektrix

•updated Sep 16, 2026•5•0•8

Detects high-volume file and data access events within Microsoft 365 services (SharePoint, OneDrive, Exchange) originating from Python-based user agents (e.g., 'python-requests', 'python-httpx'). This pattern is indicative of automated scraping, data exfiltration, or bulk activity performed by unauthorized scripts.