DNS/TLS query to known passkey/SSO phishing impersonation domains
Detects DNS queries and TLS SNI traffic directed towards known malicious domains associated with passkey and SSO phishing campaigns, specifically attributed to Storm-3121 and Storm-3032. These domains are used to deceive users into providing credentials or authentication tokens via fraudulent login portals.
Suricata
