Python-httpx automated bulk transfer against Microsoft Graph API

Ibrahim Saud@tektrix

•updated Sep 16, 2026•1•0•1

This rule detects high-frequency network activity directed toward the Microsoft Graph API (graph.microsoft.com) utilizing the 'python-httpx' user agent. This pattern matches known exfiltration activity associated with Storm-3121/Storm-3032 threat groups, where automated scripts are used to move data out of the environment via legitimate cloud service APIs.