Langflow/Python process querying cloud IMDS and Azure WireServer for credentials

ills3c Intel&Coffee@Ills3C

•updated yesterday•0•0•0

Detects a Python-based process (such as Langflow, AutoAgent, uvicorn, or gunicorn) contacting both the Azure WireServer IP (168.63.129.16) and the link-local instance metadata service (169.254.169.254) within a 30-minute window, indicating potential credential or metadata harvesting.