Langflow cryptominer: firewall disable and security agent kill after curl/wget

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•10

This rule detects potential post-exploitation activity on Linux systems where a web application process (e.g., Python-based servers like uvicorn or gunicorn) initiates network requests using curl or wget, followed within 30 minutes by attempts to disable the system firewall or terminate security monitoring agents.