High-volume SharePoint/OneDrive/Exchange access via python-httpx client

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

Detects cloud data access or file download operations in Microsoft 365 (SharePoint, OneDrive, Exchange) performed by a user agent string associated with the python-httpx library. This pattern is often indicative of automated data exfiltration using custom scripts.