High-volume SharePoint/OneDrive access via python-httpx user agent

Ibrahim Saud@tektrix

•updated Sep 18, 2026•2•1•6

Detects anomalous, high-volume file access or download activity in Microsoft SharePoint Online or OneDrive for Business originating from a 'python-httpx' user agent. This pattern often indicates automated data collection or exfiltration attempts using programmatic tools.