Python-driven mass SharePoint/OneDrive/Exchange data collection

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•1

Detects high-volume file download or data access events across SharePoint, OneDrive, and Exchange Online. This rule monitors for requests from Python-based HTTP libraries (httpx, requests, urllib) targeting Microsoft Graph API endpoints, which is a pattern indicative of automated bulk data collection or exfiltration, often observed in campaigns like Storm-3121 or Storm-3032.