Base64-encoded Python execution spawned from web application (Langflow) process

Duo Tech@duotech

•updated Jul 8, 2026•2•0•3

This rule detects Python processes initiated or executed in association with 'langflow'. It flags instances where Python is invoked with command-line arguments containing Base64 decoding patterns or '-c' flags, which are commonly used by attackers to execute obfuscated or staged payloads within a Python environment.