Langflow Host Pivot to MySQL/Nacos Database Server via Outbound Network Connection

Duo Tech@duotech

•updated Jul 8, 2026•1•0•1

This rule monitors outbound network connections from internal hosts to specific ports associated with database management (MySQL: 3306) and service orchestration/discovery (Nacos: 8848, 9848). It aggregates connection counts and distinct target IP addresses by source host and initiating process. High volumes of connections to these specific service ports from unexpected processes may indicate unauthorized discovery, brute-force attempts, or lateral movement.