Langflow host sweep
Detects Python or shell processes executing inline code or command-line parameters that reference Langflow database files ('langflow.db'), environment variables ('os.environ', 'os.getenv'), configuration files ('.env'), and sensitive keywords such as apikey, credential, variable, provider, or sqlite, indicating potential credential harvesting or environment enumeration.
Microsoft Sentinel (KQL)
