CVE-2026-33017 Langflow RCE - Dropper Download via curl/wget from Raw IP
Detects instances where Python-based applications or web frameworks (uvicorn, gunicorn, langflow) initiate external network requests using 'curl' or 'wget' to download files. The rule specifically looks for command-line arguments involving IP-based URLs and indicators of script execution, shell access, or known cryptocurrency miners.
Microsoft Sentinel (KQL)
