CaptiveCrunch Doppelganger MS Domain Access via Captive-Portal Redirect Chain
Detects DNS resolution of Microsoft-lookalike doppelganger domains within 60 seconds of an HTTP redirect on the same host/session, consistent with CaptiveCrunch captive-portal hijacking.
Cortex XDR
