Node-RED webshell flow: http in to function to exec with addpay
Detects Node-RED admin API flow deployments (POST /flows) where the payload contains an 'http in' node, a 'function' node, an 'exec' node, and 'addpay' enabled, which can indicate malicious workflow deployment or command execution attempts.
Microsoft Sentinel (KQL)
