Cloudflare Turnstile challenge gate preceding fake Microsoft login form render
Detects HTTP requests to known Cloudflare Turnstile challenge endpoints or challenge platform scripts which are commonly abused by phishing kits (e.g., Kratos) to act as an anti-sandbox or anti-scanner gate before delivering malicious content.
Microsoft Sentinel (KQL)
