Midnight Blizzard CaptiveCrunch — WPAD abuse after joining an untrusted/guest network
This rule detects potential Web Proxy Auto-Discovery (WPAD) abuse by monitoring for network requests to 'wpad.dat' or 'wpad' resources on port 80, specifically on endpoints that have been tagged as connected to untrusted or public networks (e.g., guest, hotel, public). WPAD abuse is a common technique used by attackers to force devices to use a malicious proxy, enabling traffic interception and potential credential theft.
Microsoft Sentinel (KQL)
