Passkey/SSO phishing domain access (Storm-3121/Storm-3032)

Arnold Chan@slaz

•updated 29 days ago•4•0•8

This rule monitors network traffic, DNS queries, and user web clicks to detect interactions with known malicious domains associated with credential harvesting and phishing campaigns, specifically those impersonating security or SSO portals.