Internal Teams messages spreading passkey/SSO enrollment lures

Ibrahim Saud@tektrix

•updated Sep 16, 2026•4•0•5

This rule detects potentially malicious messages sent via Microsoft Teams that contain keywords related to passkey enrollment or SSO updates, which are common social engineering tactics used in phishing campaigns to trick users into compromising their account credentials or security settings.