oauth device code phishing repeated prompts
Detects repeated OAuth device authorization ('device code') grant flow authentication events targeting the same user within a short window, which is indicative of an active device code phishing attempt.
YARA-L
