Sustained low-and-slow cloud data access by automated client (proxy)

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•4

Detects individual file access events performed by non-browser python processes. This rule is designed as a proxy to identify automated file collection activities, such as those performed by 'python-httpx', that may be indicative of low-volume data exfiltration when aggregated over time.