elastic / detection-rules-dac-demo - File Age & Freshness

File age measurements show the distribution of file ages (days since the first commit) and the file freshness (days since the latest commit).

Summary

Number of files: 1,614
Daily file updates (only one update per file and date counted): 3751
First update: 2020-06-30
Latest update: 2025-03-15
Days between first and latest update: 1,720 (245 weeks, estimated 1,225 working days)
Active days (at least one file change): 787
Data:

Organized per file

File Change History Overall

File Age Distribution Overall

Days since first update

There are 1,614 files with 160,389 lines of code in files.

1,184 files that are 366+ days old (122,519 lines of code)
285 files that are 181-365 days old (23,687 lines of code)
83 files that are 91-180 days old (8,997 lines of code)
62 files that are 31-90 days old (5,186 lines of code)
0 files that are 1-30 days old (0 lines of code)

Legend:

366+

181-365

91-180

31-90

1-30

explore: grouped by folders | grouped by age

File Freshness Distribution Overall

Days since last update

There are 1,614 files with 160,389 lines of code in files.

89 files have been last changed 366+ days ago (5,470 lines of code)
279 files have been last changed 181-365 days ago (21,774 lines of code)
958 files have been last changed 91-180 days ago (99,715 lines of code)
288 files have been last changed 31-90 days ago (33,430 lines of code)
0 files have been last changed 1-30 days ago (0 lines of code)

Legend:

366+

181-365

91-180

31-90

1-30

explore: grouped by folders | grouped by freshness

File Change History per File Extension

toml, json, md, py, yaml, txt, bash, sh, svg, gitignore, g

File Age Distribution per Extension

Days since first update

366+

181-365

91-180

31-90

1-30

File Freshness Distribution per Extension

Days since last update

366+

181-365

91-180

31-90

1-30

File Change History per Logical Decomposition

primary

primary (file age distribution)

Days since first update

366+

181-365

91-180

31-90

1-30

primary (file freshness distribution)

Days since last update

366+

181-365

91-180

31-90

1-30

Oldest Files (Top 50)

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
rule.py in detection_rules	1140	113	2020-06-30	2025-02-24	120	11	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
main.py in detection_rules	527	18	2020-06-30	2025-03-10	48	11	31489089+rw-access@users.no...	119343520+eric-forte-elasti...
rule_loader.py in detection_rules	439	43	2020-06-30	2025-03-05	36	8	31489089+rw-access@users.no...	traut@users.noreply.github.com
packaging.py in detection_rules	367	18	2020-06-30	2025-02-03	53	10	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
misc.py in detection_rules	344	17	2020-06-30	2024-08-06	40	7	31489089+rw-access@users.no...	119343520+eric-forte-elasti...
eswrap.py in detection_rules	309	23	2020-06-30	2025-03-05	30	7	31489089+rw-access@users.no...	traut@users.noreply.github.com
utils.py in detection_rules	291	39	2020-06-30	2024-08-06	36	6	31489089+rw-access@users.no...	119343520+eric-forte-elasti...
ecs.py in detection_rules	245	21	2020-06-30	2024-11-13	19	7	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
rule_formatter.py in detection_rules	200	10	2020-06-30	2025-01-22	18	7	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
beats.py in detection_rules	184	17	2020-06-30	2024-11-13	20	10	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
attack.py in detection_rules	164	10	2020-06-30	2024-05-23	14	6	31489089+rw-access@users.no...	119343520+eric-forte-elasti...
persistence_priv_escalation_via_accessibility_features.toml in rules/windows	159	-	2020-06-30	2025-02-03	51	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
privilege_escalation_unusual_parentchild_relationship.toml in rules/windows	158	-	2020-06-30	2025-02-19	55	14	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
execution_via_compiled_html_file.toml in rules/windows	155	-	2020-06-30	2025-02-19	47	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
execution_command_shell_started_by_svchost.toml in rules/windows	152	-	2020-06-30	2025-02-19	51	15	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
privilege_escalation_uac_bypass_event_viewer.toml in rules/windows	151	-	2020-06-30	2025-02-19	53	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
execution_register_server_program_connecting_to_the_internet.toml in rules/windows	148	-	2020-06-30	2025-02-03	42	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
execution_html_help_executable_program_connecting_to_the_internet.toml in rules/windows	148	-	2020-06-30	2025-02-03	36	11	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml in rules/windows	143	-	2020-06-30	2025-02-19	43	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
credential_access_credential_dumping_msbuild.toml in rules/windows	143	-	2020-06-30	2025-02-03	43	12	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
execution_command_prompt_connecting_to_the_internet.toml in rules/windows	142	-	2020-06-30	2025-02-03	33	10	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
persistence_system_shells_via_services.toml in rules/windows	135	-	2020-06-30	2025-02-19	51	14	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_via_filter_manager.toml in rules/windows	131	-	2020-06-30	2025-02-25	41	13	31489089+rw-access@users.no...	64742097+samirbous@users.no...
lateral_movement_direct_outbound_smb_connection.toml in rules/windows	128	-	2020-06-30	2025-02-05	46	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_execution_msbuild_started_by_office_app.toml in rules/windows	127	-	2020-06-30	2025-02-19	48	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_kernel_module_removal.toml in rules/linux	126	-	2020-06-30	2025-02-05	39	12	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
command_and_control_rdp_remote_desktop_protocol_from_the_internet.toml in rules/network	125	-	2020-06-30	2025-01-22	33	14	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
execution_suspicious_pdf_reader.toml in rules/windows	125	-	2020-06-30	2025-02-19	45	12	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_misc_lolbin_connecting_to_the_internet.toml in rules/windows	125	-	2020-06-30	2025-02-03	38	12	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_hidden_file_dir_tmp.toml in rules/linux	125	-	2020-06-30	2025-02-05	43	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_execution_msbuild_started_renamed.toml in rules/windows	123	-	2020-06-30	2025-02-03	43	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
lateral_movement_telnet_network_activity_internal.toml in rules/linux	119	-	2020-06-30	2025-02-05	32	12	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
lateral_movement_telnet_network_activity_external.toml in rules/linux	118	-	2020-06-30	2025-02-05	32	12	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
command_and_control_vnc_virtual_network_computing_from_the_internet.toml in rules/network	115	-	2020-06-30	2025-01-22	31	14	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml in rules/linux	115	-	2020-06-30	2025-02-05	36	12	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
persistence_adobe_hijack_persistence.toml in rules/windows	114	-	2020-06-30	2025-02-03	52	12	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
discovery_kernel_module_enumeration.toml in rules/linux	114	-	2020-06-30	2025-01-29	38	12	31489089+rw-access@users.no...	78494512+aegrah@users.norep...
defense_evasion_file_mod_writable_dir.toml in rules/linux	114	-	2020-06-30	2025-01-29	35	12	31489089+rw-access@users.no...	78494512+aegrah@users.norep...
discovery_whoami_command_activity.toml in rules/windows	113	-	2020-06-30	2025-02-25	46	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
discovery_virtual_machine_fingerprinting.toml in rules/linux	113	-	2020-06-30	2025-01-22	30	11	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
defense_evasion_attempt_to_disable_iptables_or_firewall.toml in rules/linux	113	-	2020-06-30	2025-02-05	37	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_attempt_to_disable_syslog_service.toml in rules/linux	113	-	2020-06-30	2025-02-05	38	12	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
execution_psexec_lateral_movement_command.toml in rules/windows	111	-	2020-06-30	2024-10-15	37	12	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_disable_selinux_attempt.toml in rules/linux	111	-	2020-06-30	2025-02-05	37	12	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
initial_access_smb_windows_file_sharing_activity_to_the_internet.toml in rules/network	108	-	2020-06-30	2025-01-22	31	14	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
persistence_via_application_shimming.toml in rules/windows	108	-	2020-06-30	2025-02-19	44	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_execution_msbuild_started_by_script.toml in rules/windows	108	-	2020-06-30	2025-02-19	43	14	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
command_and_control_vnc_virtual_network_computing_to_the_internet.toml in rules/network	106	-	2020-06-30	2025-01-22	31	14	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
defense_evasion_clearing_windows_event_logs.toml in rules/windows	105	-	2020-06-30	2025-02-19	50	16	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_execution_msbuild_started_unusal_process.toml in rules/windows	105	-	2020-06-30	2025-02-19	42	14	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...

Files Not Recently Changed (Top 50)

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
privilege_escalation_setgid_bit_set_via_chmod.toml in rules/_deprecated	48	-	2021-03-17	2021-03-17	1	1	brokensound77@users.noreply...	brokensound77@users.noreply...
execution_via_net_com_assemblies.toml in rules/_deprecated	46	-	2021-03-19	2021-03-19	1	1	64742097+samirbous@users.no...	64742097+samirbous@users.no...
discovery_process_discovery_via_tasklist_command.toml in rules/_deprecated	39	-	2021-04-15	2021-04-15	1	1	64742097+samirbous@users.no...	64742097+samirbous@users.no...
defense_evasion_execution_via_trusted_developer_utilities.toml in rules/_deprecated	39	-	2021-04-15	2021-04-15	1	1	64742097+samirbous@users.no...	64742097+samirbous@users.no...
linux_socat_activity.toml in rules/_deprecated	33	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
linux_mknod_activity.toml in rules/_deprecated	34	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
linux_nmap_activity.toml in rules/_deprecated	34	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
discovery_query_registry_via_reg.toml in rules/_deprecated	37	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
execution_command_shell_started_by_powershell.toml in rules/_deprecated	37	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
command_and_control_pptp_point_to_point_tunneling_protocol_activity.toml in rules/_deprecated	40	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
discovery_whoami_commmand.toml in rules/_deprecated	41	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
defense_evasion_hex_encoding_or_decoding_activity.toml in rules/_deprecated	42	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
defense_evasion_base64_encoding_or_decoding_activity.toml in rules/_deprecated	43	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
persistence_kernel_module_activity.toml in rules/_deprecated	45	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
persistence_cron_jobs_creation_and_runtime.toml in rules/_deprecated	50	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
credential_access_tcpdump_activity.toml in rules/_deprecated	52	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
command_and_control_sql_server_port_activity_to_the_internet.toml in rules/_deprecated	56	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
command_and_control_port_8000_activity_to_the_internet.toml in rules/_deprecated	57	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
command_and_control_proxy_port_activity_to_the_internet.toml in rules/_deprecated	60	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
command_and_control_tor_activity_to_the_internet.toml in rules/_deprecated	60	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
command_and_control_smtp_to_the_internet.toml in rules/_deprecated	65	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
command_and_control_irc_internet_relay_chat_protocol_activity_to_the_internet.toml in rules/_deprecated	68	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
command_and_control_ftp_file_transfer_protocol_activity_to_the_internet.toml in rules/_deprecated	69	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
command_and_control_ssh_secure_shell_to_the_internet.toml in rules/_deprecated	58	-	2021-04-21	2021-07-29	2	2	56412096+bm11100@users.nore...	brokensound77@users.noreply...
initial_access_rdp_remote_desktop_protocol_to_the_internet.toml in rules/_deprecated	72	-	2021-04-21	2021-07-29	2	2	56412096+bm11100@users.nore...	brokensound77@users.noreply...
command_and_control_ssh_secure_shell_from_the_internet.toml in rules/_deprecated	79	-	2021-04-21	2021-07-29	2	2	56412096+bm11100@users.nore...	brokensound77@users.noreply...
defense_evasion_mshta_making_network_connections.toml in rules/_deprecated	42	-	2021-10-20	2021-10-20	1	1	brokensound77@users.noreply...	brokensound77@users.noreply...
exfiltration_rds_snapshot_export.toml in rules/_deprecated	40	-	2021-10-26	2021-10-26	1	1	brokensound77@users.noreply...	brokensound77@users.noreply...
privilege_escalation_printspooler_malicious_driver_file_changes.toml in rules/_deprecated	43	-	2022-03-17	2022-03-17	1	1	jonhnathancesar@gmail.com	jonhnathancesar@gmail.com
privilege_escalation_printspooler_malicious_registry_modification.toml in rules/_deprecated	43	-	2022-03-17	2022-03-17	1	1	jonhnathancesar@gmail.com	jonhnathancesar@gmail.com
execution_flock_binary.toml in rules/_deprecated	42	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_vi_binary.toml in rules/_deprecated	42	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_env_binary.toml in rules/_deprecated	42	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_busybox_binary.toml in rules/_deprecated	42	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_crash_binary.toml in rules/_deprecated	42	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_awk_binary_shell.toml in rules/_deprecated	43	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_mysql_binary.toml in rules/_deprecated	44	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_gcc_binary.toml in rules/_deprecated	44	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_c89_c99_binary.toml in rules/_deprecated	44	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_expect_binary.toml in rules/_deprecated	44	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_find_binary.toml in rules/_deprecated	44	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_cpulimit_binary.toml in rules/_deprecated	45	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_apt_binary.toml in rules/_deprecated	45	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_ssh_binary.toml in rules/_deprecated	45	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_linux_process_started_in_temp_directory.toml in rules/_deprecated	42	-	2022-07-26	2022-07-26	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
defense_evasion_attempt_to_disable_iptables_or_firewall.toml in rules/_deprecated	44	-	2022-07-26	2022-07-26	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
initial_access_login_time.toml in rules/_deprecated	44	-	2022-07-26	2022-07-26	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
initial_access_login_sessions.toml in rules/_deprecated	44	-	2022-07-26	2022-07-26	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
initial_access_login_location.toml in rules/_deprecated	44	-	2022-07-26	2022-07-26	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
initial_access_login_failures.toml in rules/_deprecated	44	-	2022-07-26	2022-07-26	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...

Most Recently Created Files (Top 50)

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
credential_access_collection_sensitive_files_compression_inside_a_container.toml in rules/_deprecated	121	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
discovery_suspicious_network_tool_launched_inside_a_container.toml in rules/_deprecated	107	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_interactive_exec_to_container.toml in rules/_deprecated	104	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
initial_access_ssh_connection_established_inside_a_container.toml in rules/_deprecated	103	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
persistence_ssh_authorized_keys_modification_inside_a_container.toml in rules/_deprecated	102	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
lateral_movement_ssh_process_launched_inside_a_container.toml in rules/_deprecated	101	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_netcat_listener_established_inside_a_container.toml in rules/_deprecated	95	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_file_made_executable_via_chmod_inside_a_container.toml in rules/_deprecated	91	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
credential_access_sensitive_keys_or_passwords_search_inside_a_container.toml in rules/_deprecated	90	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_interactive_shell_spawned_from_inside_a_container.toml in rules/_deprecated	89	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_container_management_binary_launched_inside_a_container.toml in rules/_deprecated	82	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
privilege_escalation_debugfs_launched_inside_a_privileged_container.toml in rules/_deprecated	81	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
credential_access_aws_creds_search_inside_a_container.toml in rules/_deprecated	81	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
privilege_escalation_potential_container_escape_via_modified_notify_on_release_file.toml in rules/_deprecated	81	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
privilege_escalation_potential_container_escape_via_modified_release_agent_file.toml in rules/_deprecated	80	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
privilege_escalation_mount_launched_inside_a_privileged_container.toml in rules/_deprecated	80	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
defense_evasion_ld_preload_shared_object_modified_inside_a_container.toml in rules/_deprecated	77	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
container_workload_protection.toml in rules/_deprecated	61	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
defense_evasion_var_log_file_creation_by_unsual_process.toml in rules/linux	101	-	2025-03-12	2025-03-12	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
credential_access_entra_password_spraying_non_interactive_sfa.toml in rules/integrations/azure	132	-	2025-03-11	2025-03-11	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
initial_access_entra_rare_authentication_requirement_for_principal_user.toml in rules/integrations/azure	100	-	2025-03-11	2025-03-11	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
initial_access_entra_rare_app_id_for_principal_auth.toml in rules/integrations/azure	98	-	2025-03-11	2025-03-11	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
entra_authentication_attempts_behind_rare_user_agents.toml in hunting/azure/queries	75	-	2025-03-11	2025-03-11	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
entra_unusual_client_app_auth_request_on_behalf_of_user.toml in hunting/azure/queries	55	-	2025-03-11	2025-03-11	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
entra_excessive_non_interactive_sfa_sign_ins_across_users.toml in hunting/azure/queries	55	-	2025-03-11	2025-03-11	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
persistence_web_server_sus_command_execution.toml in rules/linux	129	-	2025-03-06	2025-03-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
persistence_web_server_sus_child_spawned.toml in rules/linux	124	-	2025-03-06	2025-03-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
persistence_web_server_sus_file_creation.toml in rules_building_block	121	-	2025-03-06	2025-03-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
persistence_web_server_sus_destination_port.toml in rules/linux	114	-	2025-03-06	2025-03-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
ml_high_count_events_for_a_host_name.toml in rules/ml	78	-	2025-03-06	2025-03-06	1	1	109447885+sodhikirti07@user...	109447885+sodhikirti07@user...
ml_low_count_events_for_a_host_name.toml in rules/ml	77	-	2025-03-06	2025-03-06	1	1	109447885+sodhikirti07@user...	109447885+sodhikirti07@user...
discovery_subnet_scanning_activity_from_compromised_host.toml in rules/linux	77	-	2025-03-06	2025-03-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
discovery_port_scanning_activity_from_compromised_host.toml in rules/linux	77	-	2025-03-06	2025-03-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
discovery_docker_socket_discovery.toml in rules/linux	75	-	2025-03-06	2025-03-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
defense_evasion_wdac_policy_by_unusual_process.toml in rules/windows	74	-	2025-03-04	2025-03-04	1	1	64742097+samirbous@users.no...	64742097+samirbous@users.no...
azure_openai_denial_of_ml_service_detection.toml in rules/integrations/azure_openai	49	-	2025-03-04	2025-03-04	1	1	mikaayenson@users.noreply.g...	mikaayenson@users.noreply.g...
azure_openai_model_theft_detection.toml in rules/integrations/azure_openai	47	-	2025-03-04	2025-03-04	1	1	mikaayenson@users.noreply.g...	mikaayenson@users.noreply.g...
azure_openai_insecure_output_handling_detection.toml in rules/integrations/azure_openai	45	-	2025-03-04	2025-03-04	1	1	mikaayenson@users.noreply.g...	mikaayenson@users.noreply.g...
initial_access_cross_site_scripting.toml in rules/_deprecated	42	-	2025-03-04	2025-03-04	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
persistence_pth_file_creation.toml in rules/linux	114	-	2025-03-03	2025-03-03	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
persistence_site_and_user_customize_file_creation.toml in rules/linux	109	-	2025-03-03	2025-03-03	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
initial_access_successful_ssh_authentication_by_unusual_user.toml in rules/linux	53	-	2025-03-03	2025-03-03	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
defense_evasion_base64_decoding_activity.toml in rules/linux	109	-	2025-02-28	2025-02-28	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
defense_evasion_interpreter_launched_from_decoded_payload.toml in rules/linux	103	-	2025-02-28	2025-02-28	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
defense_evasion_kill_command_executed.toml in rules/linux	96	-	2025-02-28	2025-02-28	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
exfiltration_unusual_file_transfer_utility_launched.toml in rules/linux	78	-	2025-02-28	2025-02-28	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
initial_access_first_time_public_key_authentication.toml in rules/linux	71	-	2025-02-28	2025-02-28	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
initial_access_successful_ssh_authentication_by_unusual_ip.toml in rules/linux	65	-	2025-02-28	2025-02-28	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
defense_evasion_authorized_keys_file_deletion.toml in rules/linux	73	-	2025-02-27	2025-02-27	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
persistence_user_credential_modification_via_echo.toml in rules/linux	69	-	2025-02-27	2025-02-27	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...

Most Recently Changed Files (Top 50)

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
pyproject.toml in root	62	-	2022-01-26	2025-03-15	52	10	richard.boyd@elastic.co	119343520+eric-forte-elasti...
credential_access_collection_sensitive_files_compression_inside_a_container.toml in rules/_deprecated	121	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
discovery_suspicious_network_tool_launched_inside_a_container.toml in rules/_deprecated	107	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_interactive_exec_to_container.toml in rules/_deprecated	104	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
initial_access_ssh_connection_established_inside_a_container.toml in rules/_deprecated	103	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
persistence_ssh_authorized_keys_modification_inside_a_container.toml in rules/_deprecated	102	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
lateral_movement_ssh_process_launched_inside_a_container.toml in rules/_deprecated	101	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
defense_evasion_execution_suspicious_explorer_winword.toml in rules/windows	100	-	2020-09-22	2025-03-14	38	13	64742097+samirbous@users.no...	64742097+samirbous@users.no...
execution_netcat_listener_established_inside_a_container.toml in rules/_deprecated	95	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_file_made_executable_via_chmod_inside_a_container.toml in rules/_deprecated	91	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
credential_access_sensitive_keys_or_passwords_search_inside_a_container.toml in rules/_deprecated	90	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_interactive_shell_spawned_from_inside_a_container.toml in rules/_deprecated	89	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_container_management_binary_launched_inside_a_container.toml in rules/_deprecated	82	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
privilege_escalation_debugfs_launched_inside_a_privileged_container.toml in rules/_deprecated	81	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
credential_access_aws_creds_search_inside_a_container.toml in rules/_deprecated	81	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
privilege_escalation_potential_container_escape_via_modified_notify_on_release_file.toml in rules/_deprecated	81	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
privilege_escalation_potential_container_escape_via_modified_release_agent_file.toml in rules/_deprecated	80	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
privilege_escalation_mount_launched_inside_a_privileged_container.toml in rules/_deprecated	80	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
defense_evasion_ld_preload_shared_object_modified_inside_a_container.toml in rules/_deprecated	77	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
container_workload_protection.toml in rules/_deprecated	61	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
defense_evasion_var_log_file_creation_by_unsual_process.toml in rules/linux	101	-	2025-03-12	2025-03-12	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
credential_access_entra_password_spraying_non_interactive_sfa.toml in rules/integrations/azure	132	-	2025-03-11	2025-03-11	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
initial_access_entra_rare_authentication_requirement_for_principal_user.toml in rules/integrations/azure	100	-	2025-03-11	2025-03-11	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
initial_access_entra_rare_app_id_for_principal_auth.toml in rules/integrations/azure	98	-	2025-03-11	2025-03-11	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
entra_authentication_attempts_behind_rare_user_agents.toml in hunting/azure/queries	75	-	2025-03-11	2025-03-11	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
entra_unusual_client_app_auth_request_on_behalf_of_user.toml in hunting/azure/queries	55	-	2025-03-11	2025-03-11	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
entra_excessive_non_interactive_sfa_sign_ins_across_users.toml in hunting/azure/queries	55	-	2025-03-11	2025-03-11	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
main.py in detection_rules	527	18	2020-06-30	2025-03-10	48	11	31489089+rw-access@users.no...	119343520+eric-forte-elasti...
kbwrap.py in detection_rules	332	5	2020-10-07	2025-03-10	27	8	brokensound77@users.noreply...	119343520+eric-forte-elasti...
ml.py in detection_rules	327	35	2021-06-03	2025-03-10	5	4	brokensound77@users.noreply...	119343520+eric-forte-elasti...
custom_rules.py in detection_rules	106	4	2024-08-06	2025-03-10	3	2	119343520+eric-forte-elasti...	119343520+eric-forte-elasti...
devtools.py in detection_rules	1053	44	2020-10-07	2025-03-07	90	11	brokensound77@users.noreply...	traut@users.noreply.github.com
docs.py in detection_rules	699	60	2020-09-30	2025-03-07	22	7	brokensound77@users.noreply...	traut@users.noreply.github.com
persistence_web_server_sus_command_execution.toml in rules/linux	129	-	2025-03-06	2025-03-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
persistence_web_server_sus_child_spawned.toml in rules/linux	124	-	2025-03-06	2025-03-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
persistence_web_server_sus_file_creation.toml in rules_building_block	121	-	2025-03-06	2025-03-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
persistence_web_server_sus_destination_port.toml in rules/linux	114	-	2025-03-06	2025-03-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
execution_unix_socket_communication.toml in rules/linux	88	-	2024-10-18	2025-03-06	6	3	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
ml_high_count_events_for_a_host_name.toml in rules/ml	78	-	2025-03-06	2025-03-06	1	1	109447885+sodhikirti07@user...	109447885+sodhikirti07@user...
ml_low_count_events_for_a_host_name.toml in rules/ml	77	-	2025-03-06	2025-03-06	1	1	109447885+sodhikirti07@user...	109447885+sodhikirti07@user...
discovery_subnet_scanning_activity_from_compromised_host.toml in rules/linux	77	-	2025-03-06	2025-03-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
discovery_port_scanning_activity_from_compromised_host.toml in rules/linux	77	-	2025-03-06	2025-03-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
discovery_docker_socket_discovery.toml in rules/linux	75	-	2025-03-06	2025-03-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
rule_loader.py in detection_rules	439	43	2020-06-30	2025-03-05	36	8	31489089+rw-access@users.no...	traut@users.noreply.github.com
eswrap.py in detection_rules	309	23	2020-06-30	2025-03-05	30	7	31489089+rw-access@users.no...	traut@users.noreply.github.com
__init__.py in detection_rules/schemas	210	37	2020-07-23	2025-03-05	47	9	31489089+rw-access@users.no...	traut@users.noreply.github.com
cli_utils.py in detection_rules	198	3	2021-03-09	2025-03-05	20	9	31489089+rw-access@users.no...	traut@users.noreply.github.com
__init__.py in detection_rules	36	-	2020-06-30	2025-03-05	15	6	31489089+rw-access@users.no...	traut@users.noreply.github.com
defense_evasion_wdac_policy_by_unusual_process.toml in rules/windows	74	-	2025-03-04	2025-03-04	1	1	64742097+samirbous@users.no...	64742097+samirbous@users.no...
azure_openai_denial_of_ml_service_detection.toml in rules/integrations/azure_openai	49	-	2025-03-04	2025-03-04	1	1	mikaayenson@users.noreply.g...	mikaayenson@users.noreply.g...