IBM Langflow Code Injection Exploitation (CVE-2026-9198)

let LangflowHosts = dynamic(["langflow", "7860"]);
DeviceProcessEvents
| where InitiatingProcessCommandLine has_any ("langflow", "python -m langflow", "uvicorn") or InitiatingProcessFolderPath has "langflow"
| where FileName in~ ("bash", "sh", "powershell.exe", "cmd.exe", "python.exe", "python3", "curl", "wget", "nc", "ncat", "perl", "ruby")
| where ProcessCommandLine has_any ("/bin/sh -c", "eval(", "exec(", "os.system", "subprocess", "base64 -d", "IEX", "Invoke-Expression", "curl http", "wget http", "0>&1")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc

index=* (sourcetype=wineventlog OR sourcetype=linux_secure OR sourcetype=syslog OR sourcetype=sysmon)
| search (parent_process_name="python*" OR parent_process_name="uvicorn*" OR parent_process_path="*langflow*")
| search (process_name="bash" OR process_name="sh" OR process_name="powershell.exe" OR process_name="cmd.exe" OR process="*curl*" OR process="*wget*" OR process="*nc *" OR process="*/bin/sh -c*")
| eval suspicious=if(match(process,"(?i)(eval\(|exec\(|os\.system|subprocess|base64 -d|IEX|Invoke-Expression|0>&1)"),1,0)
| where suspicious=1
| table _time, host, parent_process_name, parent_process_path, process_name, process, user
| sort -_time

sequence by host.name with maxspan=1m
  [process where event.type == "start" and (process.parent.name : "python*" or process.parent.executable : "*langflow*" or process.parent.command_line : "*uvicorn*")]
  [process where event.type == "start" and process.name : ("bash", "sh", "powershell.exe", "cmd.exe", "curl", "wget", "nc", "ncat") and process.command_line : ("*eval(*", "*exec(*", "*os.system*", "*subprocess*", "*base64 -d*", "*IEX*", "*0>&1*")]

SELECT DATEFORMAT(devicetime,'YYYY-MM-dd HH:mm:ss') AS EventTime, sourceip, "Process Name", "Process CommandLine", "Parent Process Name", username
FROM events
WHERE ("Parent Process Name" ILIKE '%langflow%' OR "Parent Process Name" ILIKE '%uvicorn%' OR "Parent Process Name" ILIKE '%python%')
AND ("Process Name" ILIKE '%bash%' OR "Process Name" ILIKE '%sh%' OR "Process Name" ILIKE '%powershell%' OR "Process Name" ILIKE '%cmd.exe%' OR "Process CommandLine" ILIKE '%curl%' OR "Process CommandLine" ILIKE '%wget%')
AND ("Process CommandLine" ILIKE '%eval(%' OR "Process CommandLine" ILIKE '%exec(%' OR "Process CommandLine" ILIKE '%os.system%' OR "Process CommandLine" ILIKE '%subprocess%' OR "Process CommandLine" ILIKE '%base64 -d%' OR "Process CommandLine" ILIKE '%0>&1%')
LAST 24 HOURS

_sourceCategory=*endpoint* OR _sourceCategory=*sysmon*
| where parent_process_name matches "*langflow*" or parent_process_name matches "*uvicorn*" or parent_process_name matches "*python*"
| where process_name matches "*bash*" or process_name matches "*sh*" or process_name matches "*powershell*" or process_name matches "*cmd.exe*" or command_line matches "*curl*" or command_line matches "*wget*"
| where command_line matches "*eval(*" or command_line matches "*exec(*" or command_line matches "*os.system*" or command_line matches "*subprocess*" or command_line matches "*base64 -d*" or command_line matches "*0>&1*"
| fields _messagetime, host, parent_process_name, process_name, command_line, user
| sort -_messagetime

rule langflow_code_injection_cve_2026_9198 {
  meta:
    author = "df00tech"
    description = "Detects CVE-2026-9198 IBM Langflow code injection exploitation via suspicious child process execution"
    severity = "CRITICAL"
  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.parent_process.file.full_path = /(?i)(langflow|uvicorn|python)/
    $proc.target.process.file.full_path = /(?i)(bash|sh|powershell\.exe|cmd\.exe|curl|wget|nc|ncat)/
    $proc.target.process.command_line = /(?i)(eval\(|exec\(|os\.system|subprocess|base64 -d|IEX|Invoke-Expression|0>&1)/
  condition:
    $proc
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)(langflow|uvicorn|python)/
| in(field=FileName, values=["bash", "sh", "powershell.exe", "cmd.exe", "curl", "wget", "nc", "ncat"])
| CommandLine=/(?i)(eval\(|exec\(|os\.system|subprocess|base64 -d|IEX|Invoke-Expression|0>&1)/
| table([ComputerName, ParentBaseFileName, FileName, CommandLine, UserName, timestamp])
| sort(timestamp, order=desc)