elastic / cortado - File Age & Freshness

File age measurements show the distribution of file ages (days since the first commit) and the file freshness (days since the latest commit).

Summary

Number of files: 636
Daily file updates (only one update per file and date counted): 716
First update: 2024-08-06
Latest update: 2025-02-13
Days between first and latest update: 192 (27 weeks, estimated 135 working days)
Active days (at least one file change): 21
Data:

Organized per file

File Change History Overall

File Age Distribution Overall

Days since first update

There are 636 files with 16,868 lines of code in files.

0 files that are 366+ days old (0 lines of code)
609 files that are 181-365 days old (16,100 lines of code)
27 files that are 91-180 days old (768 lines of code)
0 files that are 31-90 days old (0 lines of code)
0 files that are 1-30 days old (0 lines of code)

Legend:

366+

181-365

91-180

31-90

1-30

explore: grouped by folders | grouped by age

File Freshness Distribution Overall

Days since last update

There are 636 files with 16,868 lines of code in files.

0 files have been last changed 366+ days ago (0 lines of code)
603 files have been last changed 181-365 days ago (14,929 lines of code)
33 files have been last changed 91-180 days ago (1,939 lines of code)
0 files have been last changed 31-90 days ago (0 lines of code)
0 files have been last changed 1-30 days ago (0 lines of code)

Legend:

366+

181-365

91-180

31-90

1-30

explore: grouped by folders | grouped by freshness

File Change History per File Extension

py, c, yaml, txt, cpp, ps1, md, cs, vbs, xsl, sh, xml, gitignore, go, toml, csproj

File Age Distribution per Extension

Days since first update

366+

181-365

91-180

31-90

1-30

File Freshness Distribution per Extension

Days since last update

366+

181-365

91-180

31-90

1-30

File Change History per Logical Decomposition

primary

primary (file age distribution)

Days since first update

366+

181-365

91-180

31-90

1-30

primary (file freshness distribution)

Days since last update

366+

181-365

91-180

31-90

1-30

Oldest Files (Top 50)

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
_common.py in cortado/rtas	429	36	2024-08-06	2025-02-05	11	2	sergey@polzunov.com	traut@users.noreply.github.com
collection_keylog_rawinputdevice.py in cortado/rtas	233	1	2024-08-06	2025-02-05	6	2	sergey@polzunov.com	traut@users.noreply.github.com
credaccess_reg_query_privesc_token_manip.py in cortado/rtas	123	1	2024-08-06	2024-10-02	4	2	sergey@polzunov.com	sergey@polzunov.com
__init__.py in cortado/rtas	121	10	2024-08-06	2025-01-17	9	2	sergey@polzunov.com	sergey@polzunov.com
registry_persistence_create.py in cortado/rtas	91	3	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
thread_injector_intel.c in cortado/rtas/src	88	2	2024-08-06	2024-08-06	1	1	sergey@polzunov.com	sergey@polzunov.com
netcon_exec_chain.go in cortado/rtas/src	86	1	2024-08-06	2024-08-06	1	1	sergey@polzunov.com	sergey@polzunov.com
thread_injector_m1.c in cortado/rtas/src	83	2	2024-08-06	2024-08-06	1	1	sergey@polzunov.com	sergey@polzunov.com
collection_keylog_hook_keystate.py in cortado/rtas	81	4	2024-08-06	2024-10-02	4	2	sergey@polzunov.com	sergey@polzunov.com
utils.py in cortado	80	2	2024-08-06	2024-11-01	5	2	sergey@polzunov.com	traut@users.noreply.github.com
impersonate_trusted_installer.py in cortado/rtas	73	4	2024-08-06	2024-10-02	4	2	sergey@polzunov.com	sergey@polzunov.com
lateral_commands.py in cortado/rtas	66	1	2024-08-06	2024-10-08	4	2	sergey@polzunov.com	sergey@polzunov.com
rta_unhook_ldrload.cpp in cortado/rtas/src	65	2	2024-08-06	2024-08-06	1	1	sergey@polzunov.com	sergey@polzunov.com
evasion_patch_etw_amsi.py in cortado/rtas	61	1	2024-08-06	2024-10-02	4	2	sergey@polzunov.com	sergey@polzunov.com
LoadLib-Callback64.cpp in cortado/rtas/src	59	3	2024-08-06	2024-08-06	1	1	sergey@polzunov.com	sergey@polzunov.com
plist_creation.py in cortado/rtas	57	2	2024-08-06	2024-10-02	4	2	sergey@polzunov.com	sergey@polzunov.com
unusual_kerberos_client.py in cortado/rtas	55	1	2024-08-06	2024-10-02	4	2	sergey@polzunov.com	sergey@polzunov.com
enum_commands.py in cortado/rtas	55	1	2024-08-06	2024-10-08	4	2	sergey@polzunov.com	sergey@polzunov.com
installutil_network.py in cortado/rtas	54	1	2024-08-06	2024-09-19	4	2	sergey@polzunov.com	traut@users.noreply.github.com
winrar_encrypted.py in cortado/rtas	54	2	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
sensitive_file_access.py in cortado/rtas	53	1	2024-08-06	2024-10-02	4	2	sergey@polzunov.com	sergey@polzunov.com
at_command.py in cortado/rtas	53	1	2024-08-06	2024-10-02	4	2	sergey@polzunov.com	sergey@polzunov.com
werfault_persistence.py in cortado/rtas	52	1	2024-08-06	2024-09-19	4	2	sergey@polzunov.com	traut@users.noreply.github.com
unusual_ms_tool_network.py in cortado/rtas	50	2	2024-08-06	2024-09-19	4	2	sergey@polzunov.com	traut@users.noreply.github.com
inhibit_system_recovery.py in cortado/rtas	50	1	2024-08-06	2024-10-02	4	2	sergey@polzunov.com	sergey@polzunov.com
evasion_oversized_dll_load.py in cortado/rtas	48	1	2024-08-06	2024-10-08	6	2	sergey@polzunov.com	sergey@polzunov.com
funzip_extract_content.py in cortado/rtas	48	2	2024-08-06	2024-10-02	4	2	sergey@polzunov.com	sergey@polzunov.com
sip_provider.py in cortado/rtas	48	2	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
credaccess_sam_from_vss.py in cortado/rtas	47	3	2024-08-06	2024-10-02	4	2	sergey@polzunov.com	sergey@polzunov.com
linux_ditto_and_spawn_parent_child.c in cortado/rtas/src	46	1	2024-08-06	2024-08-06	1	1	sergey@polzunov.com	sergey@polzunov.com
exec_scripting_persistence_locations.py in cortado/rtas	46	1	2024-08-06	2024-10-02	4	2	sergey@polzunov.com	sergey@polzunov.com
recycle_bin_process.py in cortado/rtas	45	1	2024-08-06	2024-10-09	6	2	sergey@polzunov.com	sergey@polzunov.com
sticky_keys_write_execute.py in cortado/rtas	44	1	2024-08-06	2024-10-09	6	2	sergey@polzunov.com	sergey@polzunov.com
browser_debugging.py in cortado/rtas	44	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
wuauclt_image_load.py in cortado/rtas	43	1	2024-08-06	2024-10-02	4	2	sergey@polzunov.com	sergey@polzunov.com
brute_force_login.py in cortado/rtas	43	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
trust_provider.py in cortado/rtas	42	2	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
hosts_file_modify.py in cortado/rtas	42	1	2024-08-06	2024-09-19	4	2	sergey@polzunov.com	traut@users.noreply.github.com
lua_image_load.py in cortado/rtas	42	1	2024-08-06	2024-10-02	4	2	sergey@polzunov.com	sergey@polzunov.com
schtask_escalation.py in cortado/rtas	40	2	2024-08-06	2024-09-19	4	2	sergey@polzunov.com	traut@users.noreply.github.com
network_connection_iexplore_rundll32.py in cortado/rtas	39	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
sevenzip_encrypted.py in cortado/rtas	39	2	2024-08-06	2024-09-19	4	2	sergey@polzunov.com	traut@users.noreply.github.com
suspicious_office_descendant_fp.py in cortado/rtas	39	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
exec_ms_dotnet_clickonce.py in cortado/rtas	39	1	2024-08-06	2024-10-02	4	2	sergey@polzunov.com	sergey@polzunov.com
pkg_install_chmod.py in cortado/rtas	38	1	2024-08-06	2024-10-02	4	2	sergey@polzunov.com	sergey@polzunov.com
exec_java_via_scripting.py in cortado/rtas	38	1	2024-08-06	2024-09-19	4	2	sergey@polzunov.com	traut@users.noreply.github.com
susp_control_panel_dll_explorer.py in cortado/rtas	38	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
solarmaker_backdoor.py in cortado/rtas	37	1	2024-08-06	2024-10-02	4	2	sergey@polzunov.com	sergey@polzunov.com
ssh_bruteforce.py in cortado/rtas	37	2	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
builtin_cmd_file_delete.py in cortado/rtas	37	1	2024-08-06	2024-10-08	5	2	sergey@polzunov.com	sergey@polzunov.com

Files Not Recently Changed (Top 50)

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
pwnkit.c in cortado/rtas/src/pkexec_cve20214034	14	2	2024-08-06	2024-08-06	1	1	sergey@polzunov.com	sergey@polzunov.com
cve-2021-4034.c in cortado/rtas/src/pkexec_cve20214034	16	1	2024-08-06	2024-08-06	1	1	sergey@polzunov.com	sergey@polzunov.com
regsvr32.cs in cortado/rtas/src	17	1	2024-08-06	2024-08-06	1	1	sergey@polzunov.com	sergey@polzunov.com
DoublePersist.cs in cortado/rtas/src	19	-	2024-08-06	2024-08-06	1	1	sergey@polzunov.com	sergey@polzunov.com
sleep.c in cortado/rtas/src	22	1	2024-08-06	2024-08-06	1	1	sergey@polzunov.com	sergey@polzunov.com
create_file.c in cortado/rtas/src	33	2	2024-08-06	2024-08-06	1	1	sergey@polzunov.com	sergey@polzunov.com
faultrep.cpp in cortado/rtas/src	34	2	2024-08-06	2024-08-06	1	1	sergey@polzunov.com	sergey@polzunov.com
ditto_and_spawn.c in cortado/rtas/src	37	1	2024-08-06	2024-08-06	1	1	sergey@polzunov.com	sergey@polzunov.com
linux_ditto_and_spawn_parent_child.c in cortado/rtas/src	46	1	2024-08-06	2024-08-06	1	1	sergey@polzunov.com	sergey@polzunov.com
LoadLib-Callback64.cpp in cortado/rtas/src	59	3	2024-08-06	2024-08-06	1	1	sergey@polzunov.com	sergey@polzunov.com
rta_unhook_ldrload.cpp in cortado/rtas/src	65	2	2024-08-06	2024-08-06	1	1	sergey@polzunov.com	sergey@polzunov.com
thread_injector_m1.c in cortado/rtas/src	83	2	2024-08-06	2024-08-06	1	1	sergey@polzunov.com	sergey@polzunov.com
netcon_exec_chain.go in cortado/rtas/src	86	1	2024-08-06	2024-08-06	1	1	sergey@polzunov.com	sergey@polzunov.com
thread_injector_intel.c in cortado/rtas/src	88	2	2024-08-06	2024-08-06	1	1	sergey@polzunov.com	sergey@polzunov.com
exec_cmd_ntdsdit.py in cortado/rtas	14	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
auth_plugin.py in cortado/rtas	14	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
exec_cmd_mklink.py in cortado/rtas	14	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
exec_cmd_arp.py in cortado/rtas	14	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
emond_plist.py in cortado/rtas	14	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
exec_cmd_fsutil_fsinfo.py in cortado/rtas	14	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
login_window_plist.py in cortado/rtas	14	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
exec_cmd_clear_history.py in cortado/rtas	14	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
periodic_task_creation.py in cortado/rtas	16	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
network_connection_external_ip_lookup_non_browser.py in cortado/rtas	16	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
exec_cmd_nltest.py in cortado/rtas	16	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
vaultcmd_commands.py in cortado/rtas	16	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
file_create_lsass_dump.py in cortado/rtas	16	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
exec_cmd_posh_mailbox.py in cortado/rtas	16	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
network_connection_kerberos_port.py in cortado/rtas	16	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
delete_volume_shadows.py in cortado/rtas	16	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
file_create_task_file.py in cortado/rtas	16	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
network_connection_rdp_tunneling.py in cortado/rtas	16	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
file_delete_spool_driver.py in cortado/rtas	16	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
special_chars_zip_file.py in cortado/rtas	16	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
registry_rdp_enable.py in cortado/rtas	17	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
reg_mod_shim_sb.py in cortado/rtas	17	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
exec_cmd_wmic_antivirus_enum.py in cortado/rtas	17	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
reg_mod_enableat.py in cortado/rtas	17	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
reg_mod_suspicious_service.py in cortado/rtas	17	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
login_hook.py in cortado/rtas	17	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
exec_cmd_adfind.py in cortado/rtas	17	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
exec_cmd_hidden_share.py in cortado/rtas	17	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
lateral_command_psexec.py in cortado/rtas	17	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
exec_cmd_fltmc_unload.py in cortado/rtas	17	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
webproxy_modification.py in cortado/rtas	17	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
exec_cmd_wmi_subscription.py in cortado/rtas	17	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
root_cert_install.py in cortado/rtas	17	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
delete_usnjrnl.py in cortado/rtas	17	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
reg_mod_appinitdlls.py in cortado/rtas	17	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com
dock_plist.py in cortado/rtas	17	1	2024-08-06	2024-09-19	3	2	sergey@polzunov.com	traut@users.noreply.github.com

Most Recently Created Files (Top 50)

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
linux_python_netcon_file_creation.py in cortado/rtas	43	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_dpkg_netcon.py in cortado/rtas	39	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_motd_netcon.py in cortado/rtas	36	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_systemd_netcon.py in cortado/rtas	35	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_rpm_netcon.py in cortado/rtas	33	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_motd_netcon_parent_child.py in cortado/rtas	32	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_sus_netcon_command_exec.py in cortado/rtas	31	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_sus_netcon_file_creation.py in cortado/rtas	31	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_apt_package_manager_execution.py in cortado/rtas	31	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_execution_kill_from_executable_in_unusual_location.py in cortado/rtas	29	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_initd_unusual_binary_execution.py in cortado/rtas	29	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_direct_crontab_modification.py in cortado/rtas	29	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_systemd_executing_sus_located_binary.py in cortado/rtas	27	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_scheduled_task_executing_sus_located_binary.py in cortado/rtas	26	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_command_and_control_ip_address_arg_from_hidden_executable.py in cortado/rtas	26	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_unusual_scheduled_task_command_exection.py in cortado/rtas	25	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_cron_hidden_execution.py in cortado/rtas	25	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_initd_netcon.py in cortado/rtas	25	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_execution_hidden_process_unusual_execution.py in cortado/rtas	24	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_execution_interactive_shell_spawn_from_hidden_process.py in cortado/rtas	24	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_suspicious_echo_execution.py in cortado/rtas	24	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_hex_payload_execution.py in cortado/rtas	24	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_execution_reverse_shell_or_listener_via_socat.py in cortado/rtas	24	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_execution_setsid_nohup_unusual_execution.py in cortado/rtas	24	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_command_and_control_telegram_api_request.py in cortado/rtas	24	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_process_injection_via_dd.py in cortado/rtas	24	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_base64_xxd_decode_arg_evasion.py in cortado/rtas	24	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_execution_linux_powershell_outbound_network_connection.py in cortado/rtas	32	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_execution_cupsd_foomatic_rip_shell_execution.py in cortado/rtas	30	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_proxy_execution_via_pidstat.py in cortado/rtas	30	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_proxy_execution_via_ld_so.py in cortado/rtas	30	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_proxy_execution_via_php.py in cortado/rtas	30	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_process_masquerading_via_exec.py in cortado/rtas	30	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_proxy_execution_via_sed.py in cortado/rtas	30	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_proxy_execution_via_crash.py in cortado/rtas	30	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_proxy_execution_via_sysctl.py in cortado/rtas	30	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_proxy_execution_via_split.py in cortado/rtas	30	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_execution_renice_ulimit.py in cortado/rtas	28	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_busybox_indirect_shell_spawn.py in cortado/rtas	27	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_command_and_control_curl_wget_hidden_directory_output.py in cortado/rtas	26	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_webserver_curl_wget_piped_to_interpreter.py in cortado/rtas	26	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_execution_cupsd_foomatic_rip_suspicious_child_execution.py in cortado/rtas	26	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_webserver_curl_wget_download_ip_args.py in cortado/rtas	26	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_shebang_decoded_via_builtin_utility.py in cortado/rtas	26	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_execution_bind_shell_via_node.py in cortado/rtas	24	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_execution_bind_shell_via_nc_traditional.py in cortado/rtas	24	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_impact_enable_write_access_to_msr.py in cortado/rtas	24	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_sysctl_kernel_feature_activity.py in cortado/rtas	24	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_webserver_curl_wget_suspicious_redirect.py in cortado/rtas	24	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_proxy_execution_via_tcpdump.py in cortado/rtas	24	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com

Most Recently Changed Files (Top 50)

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
_common.py in cortado/rtas	429	36	2024-08-06	2025-02-05	11	2	sergey@polzunov.com	traut@users.noreply.github.com
collection_keylog_rawinputdevice.py in cortado/rtas	233	1	2024-08-06	2025-02-05	6	2	sergey@polzunov.com	traut@users.noreply.github.com
linux_python_netcon_file_creation.py in cortado/rtas	43	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_dpkg_netcon.py in cortado/rtas	39	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_motd_netcon.py in cortado/rtas	36	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_systemd_netcon.py in cortado/rtas	35	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_rpm_netcon.py in cortado/rtas	33	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_motd_netcon_parent_child.py in cortado/rtas	32	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_sus_netcon_command_exec.py in cortado/rtas	31	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_sus_netcon_file_creation.py in cortado/rtas	31	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_apt_package_manager_execution.py in cortado/rtas	31	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_execution_kill_from_executable_in_unusual_location.py in cortado/rtas	29	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_initd_unusual_binary_execution.py in cortado/rtas	29	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_direct_crontab_modification.py in cortado/rtas	29	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_systemd_executing_sus_located_binary.py in cortado/rtas	27	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_scheduled_task_executing_sus_located_binary.py in cortado/rtas	26	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_command_and_control_ip_address_arg_from_hidden_executable.py in cortado/rtas	26	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_unusual_scheduled_task_command_exection.py in cortado/rtas	25	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_cron_hidden_execution.py in cortado/rtas	25	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_initd_netcon.py in cortado/rtas	25	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_execution_hidden_process_unusual_execution.py in cortado/rtas	24	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_execution_interactive_shell_spawn_from_hidden_process.py in cortado/rtas	24	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_suspicious_echo_execution.py in cortado/rtas	24	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_hex_payload_execution.py in cortado/rtas	24	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_execution_reverse_shell_or_listener_via_socat.py in cortado/rtas	24	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_execution_setsid_nohup_unusual_execution.py in cortado/rtas	24	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_command_and_control_telegram_api_request.py in cortado/rtas	24	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_process_injection_via_dd.py in cortado/rtas	24	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_base64_xxd_decode_arg_evasion.py in cortado/rtas	24	1	2025-02-05	2025-02-05	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
cli.py in cortado	197	4	2024-09-16	2025-01-30	9	2	traut@users.noreply.github.com	sergey@polzunov.com
rules.py in cortado	112	8	2024-10-02	2025-01-29	7	2	sergey@polzunov.com	sergey@polzunov.com
__init__.py in cortado/rtas	121	10	2024-08-06	2025-01-17	9	2	sergey@polzunov.com	sergey@polzunov.com
_cli.py in cortado/rtas	79	3	2024-09-19	2025-01-17	7	2	traut@users.noreply.github.com	sergey@polzunov.com
linux_execution_linux_powershell_outbound_network_connection.py in cortado/rtas	32	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_execution_cupsd_foomatic_rip_shell_execution.py in cortado/rtas	30	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_proxy_execution_via_pidstat.py in cortado/rtas	30	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_proxy_execution_via_ld_so.py in cortado/rtas	30	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_proxy_execution_via_php.py in cortado/rtas	30	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_process_masquerading_via_exec.py in cortado/rtas	30	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_proxy_execution_via_sed.py in cortado/rtas	30	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_proxy_execution_via_crash.py in cortado/rtas	30	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_proxy_execution_via_sysctl.py in cortado/rtas	30	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_proxy_execution_via_split.py in cortado/rtas	30	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_execution_renice_ulimit.py in cortado/rtas	28	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_busybox_indirect_shell_spawn.py in cortado/rtas	27	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_command_and_control_curl_wget_hidden_directory_output.py in cortado/rtas	26	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_webserver_curl_wget_piped_to_interpreter.py in cortado/rtas	26	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_execution_cupsd_foomatic_rip_suspicious_child_execution.py in cortado/rtas	26	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_persistence_webserver_curl_wget_download_ip_args.py in cortado/rtas	26	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com
linux_defense_evasion_shebang_decoded_via_builtin_utility.py in cortado/rtas	26	1	2024-11-06	2024-11-06	1	1	traut@users.noreply.github.com	traut@users.noreply.github.com