Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Detecting FIDO2 Passkey Abuse

Steven Lim@KQLWizard

•updated Jul 1, 2025•5•0•114

KQL Query from file: Detecting FIDO2 Passkey Abuse

Microsoft Sentinel (KQL)

Tags

T1111 - Multi-Factor Authentication Interception TA0006 - Credential Access T1106 - Native API T1059.009 - Cloud API TA0004 - Privilege Escalation T1548.005 - Temporary Elevated Cloud Access T1591.004 - Identify Roles T1651 - Cloud Administration Command TA0002 - Execution TA0005 - Defense Evasion TA0043 - Reconnaissance Cloud Api Call Authentication Attempt Credential Access Multifactor Authentication Bypass Admin Activity Logon Event User Account Modified Azure Office 365 Azure Activity Logs Azure Signin Logs Azure Sentinel M365 Unified Audit Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?