Internal Teams spearphishing with passkey/SSO lure from compromised account

Ibrahim Saud@tektrix

•updated Sep 18, 2026•4•0•6

This rule detects potentially malicious messages within Microsoft Teams that use common social engineering keywords related to security configuration changes (e.g., passkey, MFA, SSO). The detection specifically filters for users who have successfully logged in within the last 30 days to identify potential compromised accounts acting as internal senders.