All Detections

CaptiveCrunch AitM doppelganger domain exact query (ms365-device.com)

avatar
Duo Tech@duotech
updated Aug 6, 2026002

Detects DNS/TLS/IP traffic to known CaptiveCrunch AitM doppelganger domains and C2/redirect IP infrastructure via exact-match indicators.

Suricata