Lateral MySQL/Nacos Pivot from Compromised Langflow Host
Detects lateral movement activity where a host identified as running the Langflow framework attempts to connect to internal MySQL (3306) or Nacos (8848) services while utilizing root credentials, potentially indicating an attacker pivoting from a compromised application server.
Microsoft Sentinel (KQL)
