TAG-195 ChonkyChicken WPAD Proxy Hijack: wpad_capture.ocx and wpad_* C2 Commands
This rule detects potential Web Proxy Auto-Discovery (WPAD) exploitation or manipulation. It monitors for the presence of 'wpad_capture.ocx' (often associated with WPAD-based credential capturing tools), execution of processes involving WPAD-related command-line tokens, and modifications to the 'AutoConfigURL' registry value, which is used to redirect traffic through an attacker-controlled proxy.
Cortex XDR
