CAPTCHA-Gated Redirect Cloaking Serving Differential Content to Crawlers vs Humans
This rule detects potential automated bot, crawler, or scraper activity by identifying network requests that contain suspicious strings in the URI (e.g., 'captcha') or User-Agent header (e.g., 'bot', 'crawler', 'spider'). The rule aggregates events by DNS query and remote IP, flagging entities that exhibit high-frequency requests across multiple unique User-Agents, which is a common behavior of sophisticated web scrapers or automated scanning tools attempting to bypass simple detection.
Cortex XDR
