elastic / detection-rules-dac-demo

Duplication

Places in code with 6 or more lines that are exactly the same.

Longest Duplicates

The list of 50 longest duplicates.

See data for all 204,131 duplicates...

Size	#	Folders	Files	Lines	Code
76	x 2	rules/_deprecated rules/_deprecated	threat_intel_filebeat8x.toml threat_intel_fleet_integrations.toml	97:190 (49%) 97:190 (49%)	view
68	x 2	rules/windows rules/windows	command_and_control_new_terms_commonl... command_and_control_new_terms_commonl...	138:205 (24%) 208:275 (24%)	view
55	x 2	rules/ml rules/ml	credential_access_ml_suspicious_login... initial_access_ml_auth_rare_source_ip...	22:87 (45%) 22:87 (45%)	view
55	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_lo... initial_access_ml_auth_rare_source_ip...	25:90 (44%) 22:87 (45%)	view
55	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_lo... credential_access_ml_suspicious_login...	25:90 (44%) 22:87 (45%)	view
54	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_lo... initial_access_ml_auth_rare_hour_for_...	25:89 (40%) 21:85 (49%)	view
54	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_fa... credential_access_ml_auth_spike_in_lo...	26:90 (43%) 25:89 (40%)	view
54	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_lo... initial_access_ml_auth_rare_user_logo...	25:89 (40%) 28:92 (43%)	view
54	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_fa... initial_access_ml_auth_rare_hour_for_...	26:90 (43%) 21:85 (49%)	view
54	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_fa... initial_access_ml_auth_rare_user_logo...	26:90 (43%) 28:92 (43%)	view
54	x 2	rules/ml rules/ml	initial_access_ml_auth_rare_hour_for_... initial_access_ml_auth_rare_user_logo...	21:85 (49%) 28:92 (43%)	view
53	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_lo... initial_access_ml_auth_rare_source_ip...	25:88 (39%) 22:85 (43%)	view
53	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_lo... credential_access_ml_auth_spike_in_lo...	25:88 (42%) 25:88 (39%)	view
53	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_lo... credential_access_ml_suspicious_login...	25:88 (39%) 22:85 (43%)	view
53	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_lo... initial_access_ml_auth_rare_hour_for_...	25:88 (42%) 21:84 (48%)	view
53	x 2	rules/windows rules_building_block	command_and_control_remote_file_copy_... command_and_control_certutil_network_...	6:67 (33%) 7:68 (37%)	view
53	x 2	rules/_deprecated rules/threat_intel	threat_intel_filebeat8x.toml threat_intel_indicator_match_hash.toml	97:159 (34%) 133:195 (27%)	view
53	x 2	rules/ml rules/ml	initial_access_ml_auth_rare_hour_for_... initial_access_ml_auth_rare_source_ip...	21:84 (48%) 22:85 (43%)	view
53	x 2	rules/ml rules/ml	credential_access_ml_suspicious_login... initial_access_ml_auth_rare_user_logo...	22:85 (43%) 28:91 (42%)	view
53	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_fa... credential_access_ml_auth_spike_in_lo...	26:89 (43%) 25:88 (42%)	view
53	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_fa... credential_access_ml_suspicious_login...	26:89 (43%) 22:85 (43%)	view
53	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_fa... initial_access_ml_auth_rare_source_ip...	26:89 (43%) 22:85 (43%)	view
53	x 2	rules/ml rules/ml	initial_access_ml_auth_rare_source_ip... initial_access_ml_auth_rare_user_logo...	22:85 (43%) 28:91 (42%)	view
53	x 2	rules/ml rules/ml	credential_access_ml_suspicious_login... initial_access_ml_auth_rare_hour_for_...	22:85 (43%) 21:84 (48%)	view
53	x 2	rules/ml rules/ml	credential_access_ml_auth_spike_in_lo... initial_access_ml_auth_rare_user_logo...	25:88 (42%) 28:91 (42%)	view
53	x 2	rules/_deprecated rules/threat_intel	threat_intel_fleet_integrations.toml threat_intel_indicator_match_hash.toml	97:159 (34%) 133:195 (27%)	view
51	x 2	rules/windows rules_building_block	command_and_control_remote_file_copy_... command_and_control_certutil_network_...	7:65 (33%) 10:68 (35%)	view
51	x 2	rules/windows rules/windows	command_and_control_remote_file_copy_... command_and_control_remote_file_copy_...	9:67 (32%) 7:65 (33%)	view
49	x 2	rules/linux rules/linux	discovery_linux_hping_activity.toml discovery_linux_nping_activity.toml	29:84 (42%) 29:84 (42%)	view
48	x 2	rules/integrations/okta rules/integrations/okta	credential_access_okta_authentication... credential_access_okta_multiple_devic...	30:79 (41%) 30:79 (41%)	view
47	x 2	rules/linux rules/linux	defense_evasion_chattr_immutable_file... defense_evasion_log_files_deleted.toml	25:78 (39%) 26:80 (36%)	view
47	x 2	rules/ml rules/ml	persistence_ml_rare_process_by_host_w... persistence_ml_windows_anomalous_proc...	106:160 (29%) 106:160 (27%)	view
47	x 2	rules/ml rules/ml	persistence_ml_rare_process_by_host_w... persistence_ml_windows_anomalous_proc...	106:160 (29%) 109:163 (29%)	view
47	x 2	rules/linux rules/linux	defense_evasion_hidden_shared_object.... defense_evasion_log_files_deleted.toml	24:78 (42%) 26:80 (36%)	view
47	x 2	rules/ml rules/ml	persistence_ml_windows_anomalous_proc... persistence_ml_windows_anomalous_proc...	106:160 (27%) 109:163 (29%)	view
47	x 2	rules/linux rules/linux	defense_evasion_chattr_immutable_file... defense_evasion_hidden_shared_object....	25:78 (39%) 24:78 (42%)	view
47	x 2	rules/linux rules/linux	execution_process_backgrounded_by_unu... execution_unusual_pkexec_execution.toml	57:109 (38%) 24:76 (37%)	view
45	x 2	rules/windows rules/windows	command_and_control_remote_file_copy_... command_and_control_remote_file_copy_...	1:51 (28%) 1:51 (28%)	view
45	x 2	rules/linux rules/linux	lateral_movement_telnet_network_activ... lateral_movement_telnet_network_activ...	31:82 (38%) 31:82 (37%)	view
44	x 2	rules/integrations/endpoint rules/integrations/endpoint	execution_elastic_malicious_file_dete... execution_elastic_malicious_file_prev...	111:165 (32%) 111:165 (32%)	view
44	x 2	rules/integrations/endpoint rules/integrations/endpoint	defense_evasion_elastic_memory_threat... defense_evasion_elastic_memory_threat...	120:174 (30%) 119:173 (30%)	view
43	x 2	rules/windows rules/windows	initial_access_suspicious_ms_office_c... initial_access_suspicious_ms_outlook_...	123:176 (27%) 110:166 (30%)	view
43	x 2	rules/ml rules/ml	ml_linux_anomalous_network_port_activ... ml_packetbeat_rare_server_domain.toml	21:72 (43%) 30:81 (43%)	view
42	x 2	rules/ml rules/ml	initial_access_ml_linux_anomalous_use... persistence_ml_linux_anomalous_proces...	31:81 (42%) 26:76 (34%)	view
42	x 2	rules/ml rules/ml	discovery_ml_linux_system_information... discovery_ml_linux_system_user_discov...	27:77 (36%) 27:77 (36%)	view
42	x 2	rules/ml rules/ml	credential_access_ml_linux_anomalous_... privilege_escalation_ml_linux_anomalo...	25:75 (35%) 25:75 (34%)	view
42	x 2	rules/ml rules/ml	ml_linux_anomalous_network_activity.toml persistence_ml_linux_anomalous_proces...	22:72 (51%) 26:76 (34%)	view
42	x 2	rules/integrations/aws rules/integrations/aws	impact_s3_excessive_object_encryption... impact_s3_unusual_object_encryption_w...	31:85 (40%) 32:86 (33%)	view
42	x 2	rules/windows rules/windows	privilege_escalation_uac_bypass_com_c... privilege_escalation_uac_bypass_com_i...	84:134 (37%) 87:137 (36%)	view
42	x 2	rules/ml rules/ml	discovery_ml_linux_system_information... discovery_ml_linux_system_process_dis...	27:77 (36%) 27:77 (36%)	view