CVE-2026-33017 Langflow RCE - Shell Spawn or Dropper Download from Python/Uvicorn
Detects suspicious child processes (such as shell interpreters or downloader tools) spawned by Langflow, uvicorn, or python processes. The rule focuses on common indicators of post-exploitation activity, including code execution via python arguments, use of curl/wget to pull payloads, and execution of shell scripts often associated with malware droppers.
Microsoft Sentinel (KQL)
