Mir0Auth device-code phishing kit repeated POST polling of /window.rs (application/octet-stream)

Arnold Chan@slaz

•updated 16 days ago•0•0•3

Detects repeated octet-stream POST polling of /window.rs (5+ in 20s, alerting once per window), matching the ~3s Mir0Auth session polling while the victim completes device login. SID de-duplicated from another rule.