Suspicious Child Process from AI Workflow Tool
Detects suspicious child processes spawned by Langflow or n8n workflow services, indicating potential unauthenticated Remote Code Execution (RCE) exploitation. The rule specifically looks for these applications (or their underlying node/python processes) spawning common shell processes (cmd.exe, powershell.exe, bash, etc.) which then execute commands typically associated with RCE payload retrieval or execution (wget, curl, Invoke-WebRequest, base64, iex, Invoke-Expression).
Microsoft Sentinel (KQL)
