Langflow cryptominer post-exploitation log deletion and syslog daemon kill
Detects evidence of log deletion, logrotate configuration modification, or syslog daemon termination (rsyslog, syslog-ng, journald) occurring within 30 minutes of suspicious child process activity from common web application interpreters (e.g., python, node, java, php). This correlation pattern is a strong indicator of post-exploitation activity aimed at clearing tracks or impairing host logging services.
Microsoft Sentinel (KQL)
