Rogue Captive Portal Credential Harvesting Page

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects potential rogue captive portal credential harvesting pages by inspecting HTTP responses for the presence of keywords like 'captive', 'password', and 'connect' within the file data. These keywords, when found together in a client-bound HTTP response, suggest an attempt to mimic a legitimate captive portal to steal user credentials.