Mass SharePoint/OneDrive Access via python-httpx User Agent

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

This rule detects cloud file access (Download, Accessed, or Sync) originating from a Python-based user-agent (python-httpx) associated with specific Microsoft 365 applications, flagged by either an uncommon ISP or an uncommon user-agent for that specific user. This behavior is indicative of potential automated data collection or exfiltration attempts using programmatic access against cloud storage services.