elastic / detection-rules-dac-demo - File Change Frequency

File change frequency (churn) shows the distribution of file updates (days with at least one commit).

Overview

File Change Frequency Overall

There are 1,614 files with 160,389 lines of code.

1 file changed more than 100 times (1,140 lines of code)
12 files changed 51-100 times (2,893 lines of code)
327 files changed 21-50 times (41,280 lines of code)
708 files changed 6-20 times (68,799 lines of code)
566 files changed 1-5 times (46,277 lines of code)

Legend:

101+

51-100

21-50

6-20

1-5

explore: grouped by folders | grouped by update frequency | data

Contributors Count Frequency Overall

There are 1,614 files with 160,389 lines of code.

0 files changed by more than 25 contributors (0 lines of code)
130 files changed by 11-25 contributors (17,478 lines of code)
656 files changed by 6-10 contributors (69,343 lines of code)
587 files changed by 2-5 contributors (58,680 lines of code)
241 files changed by 1 contributor (14,888 lines of code)

Legend:

26+

11-25

6-10

2-5

explore: grouped by folders | grouped by contributors count | data

File Change Frequency per File Extension

toml, json, md, py, yaml, txt, bash, sh, svg, gitignore, g

File Change Frequency per Extension

The number of recorded file updates

101+

51-100

21-50

6-20

1-5

File Change Frequency per Logical Decomposition

primary

primary (file change frequency)

The number of recorded file updates

101+

51-100

21-50

6-20

1-5

Most Frequently Changed Files (Top 50)

See data for all files...

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
rule.py in detection_rules	1140	113	2020-06-30	2025-02-24	120	11	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
devtools.py in detection_rules	1053	44	2020-10-07	2025-03-07	90	11	brokensound77@users.noreply...	traut@users.noreply.github.com
definitions.py in detection_rules/schemas	224	3	2021-03-09	2024-11-04	56	14	brokensound77@users.noreply...	26856693+w0rk3r@users.norep...
privilege_escalation_unusual_parentchild_relationship.toml in rules/windows	158	-	2020-06-30	2025-02-19	55	14	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
privilege_escalation_uac_bypass_event_viewer.toml in rules/windows	151	-	2020-06-30	2025-02-19	53	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
packaging.py in detection_rules	367	18	2020-06-30	2025-02-03	53	10	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
pyproject.toml in root	62	-	2022-01-26	2025-03-15	52	10	richard.boyd@elastic.co	119343520+eric-forte-elasti...
persistence_adobe_hijack_persistence.toml in rules/windows	114	-	2020-06-30	2025-02-03	52	12	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
persistence_system_shells_via_services.toml in rules/windows	135	-	2020-06-30	2025-02-19	51	14	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
execution_command_shell_started_by_svchost.toml in rules/windows	152	-	2020-06-30	2025-02-19	51	15	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
command_and_control_remote_file_copy_mpcmdrun.toml in rules/windows	158	-	2020-09-22	2025-02-19	51	13	64742097+samirbous@users.no...	26856693+w0rk3r@users.norep...
persistence_priv_escalation_via_accessibility_features.toml in rules/windows	159	-	2020-06-30	2025-02-03	51	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
command_and_control_remote_file_copy_desktopimgdownldr.toml in rules/windows	160	-	2020-09-22	2025-02-19	51	13	64742097+samirbous@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_clearing_windows_event_logs.toml in rules/windows	105	-	2020-06-30	2025-02-19	50	16	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_disable_windows_firewall_rules_with_netsh.toml in rules/windows	89	-	2020-06-30	2025-02-19	48	14	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
command_and_control_teamviewer_remote_file_copy.toml in rules/windows	121	-	2020-09-22	2025-02-03	48	12	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
defense_evasion_execution_msbuild_started_by_office_app.toml in rules/windows	127	-	2020-06-30	2025-02-19	48	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
main.py in detection_rules	527	18	2020-06-30	2025-03-10	48	11	31489089+rw-access@users.no...	119343520+eric-forte-elasti...
execution_via_compiled_html_file.toml in rules/windows	155	-	2020-06-30	2025-02-19	47	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
persistence_via_update_orchestrator_service_hijack.toml in rules/windows	157	-	2020-09-29	2025-02-19	47	13	64742097+samirbous@users.no...	26856693+w0rk3r@users.norep...
__init__.py in detection_rules/schemas	210	37	2020-07-23	2025-03-05	47	9	31489089+rw-access@users.no...	traut@users.noreply.github.com
persistence_user_account_creation.toml in rules/windows	88	-	2020-06-30	2025-02-19	46	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
discovery_whoami_command_activity.toml in rules/windows	113	-	2020-06-30	2025-02-25	46	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
lateral_movement_direct_outbound_smb_connection.toml in rules/windows	128	-	2020-06-30	2025-02-05	46	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
command_and_control_common_webservices.toml in rules/windows	307	-	2020-11-18	2025-02-03	46	10	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
defense_evasion_execution_msbuild_started_by_system_process.toml in rules/windows	100	-	2020-06-30	2025-02-19	45	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
execution_suspicious_pdf_reader.toml in rules/windows	125	-	2020-06-30	2025-02-19	45	12	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
privilege_escalation_printspooler_suspicious_spl_file.toml in rules/windows	132	-	2020-09-29	2025-02-03	45	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
persistence_via_application_shimming.toml in rules/windows	108	-	2020-06-30	2025-02-19	44	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_execution_msbuild_started_by_script.toml in rules/windows	108	-	2020-06-30	2025-02-19	43	14	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
collection_email_powershell_exchange_mailbox.toml in rules/windows	122	-	2020-12-15	2025-02-19	43	11	64742097+samirbous@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_execution_msbuild_started_renamed.toml in rules/windows	123	-	2020-06-30	2025-02-03	43	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_hidden_file_dir_tmp.toml in rules/linux	125	-	2020-06-30	2025-02-05	43	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_system_critical_proc_abnormal_file_activity.toml in rules/windows	129	-	2020-09-22	2025-02-03	43	12	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
defense_evasion_suspicious_zoom_child_process.toml in rules/windows	137	-	2020-09-30	2025-02-19	43	13	64742097+samirbous@users.no...	26856693+w0rk3r@users.norep...
credential_access_credential_dumping_msbuild.toml in rules/windows	143	-	2020-06-30	2025-02-03	43	12	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml in rules/windows	143	-	2020-06-30	2025-02-19	43	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
execution_python_tty_shell.toml in rules/linux	102	-	2020-06-30	2025-02-05	42	14	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_execution_msbuild_started_unusal_process.toml in rules/windows	105	-	2020-06-30	2025-02-19	42	14	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_masquerading_suspicious_werfault_childproc.toml in rules/windows	121	-	2020-09-22	2025-01-22	42	13	64742097+samirbous@users.no...	mikaayenson@users.noreply.g...
privilege_escalation_uac_bypass_diskcleanup_hijack.toml in rules/windows	130	-	2020-09-22	2025-02-19	42	12	64742097+samirbous@users.no...	26856693+w0rk3r@users.norep...
execution_register_server_program_connecting_to_the_internet.toml in rules/windows	148	-	2020-06-30	2025-02-03	42	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
execution_from_unusual_path_cmdline.toml in rules/windows	239	-	2020-12-08	2025-02-19	42	11	64742097+samirbous@users.no...	26856693+w0rk3r@users.norep...
credential_access_domain_backup_dpapi_private_keys.toml in rules/windows	52	-	2020-09-29	2025-01-22	41	12	64742097+samirbous@users.no...	mikaayenson@users.noreply.g...
credential_access_mimikatz_memssp_default_logs.toml in rules/windows	83	-	2020-09-22	2024-10-15	41	12	64742097+samirbous@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_masquerading_as_elastic_endpoint_process.toml in rules/windows	112	-	2020-09-22	2025-02-19	41	13	64742097+samirbous@users.no...	26856693+w0rk3r@users.norep...
persistence_via_telemetrycontroller_scheduledtask_hijack.toml in rules/windows	121	-	2020-09-22	2025-02-19	41	13	64742097+samirbous@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_via_filter_manager.toml in rules/windows	131	-	2020-06-30	2025-02-25	41	13	31489089+rw-access@users.no...	64742097+samirbous@users.no...
persistence_startup_folder_scripts.toml in rules/windows	133	-	2020-12-08	2025-02-03	41	10	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
privilege_escalation_uac_bypass_mock_windir.toml in rules/windows	152	-	2020-12-08	2025-02-19	41	11	64742097+samirbous@users.no...	26856693+w0rk3r@users.norep...

Files With Most Contributors (Top 50)

Based on the number of unique email addresses found in commits.

See data for all files...

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
defense_evasion_clearing_windows_event_logs.toml in rules/windows	105	-	2020-06-30	2025-02-19	50	16	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
execution_command_shell_started_by_svchost.toml in rules/windows	152	-	2020-06-30	2025-02-19	51	15	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
definitions.py in detection_rules/schemas	224	3	2021-03-09	2024-11-04	56	14	brokensound77@users.noreply...	26856693+w0rk3r@users.norep...
privilege_escalation_unusual_parentchild_relationship.toml in rules/windows	158	-	2020-06-30	2025-02-19	55	14	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
persistence_system_shells_via_services.toml in rules/windows	135	-	2020-06-30	2025-02-19	51	14	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_disable_windows_firewall_rules_with_netsh.toml in rules/windows	89	-	2020-06-30	2025-02-19	48	14	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_execution_msbuild_started_by_script.toml in rules/windows	108	-	2020-06-30	2025-02-19	43	14	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_execution_msbuild_started_unusal_process.toml in rules/windows	105	-	2020-06-30	2025-02-19	42	14	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
execution_python_tty_shell.toml in rules/linux	102	-	2020-06-30	2025-02-05	42	14	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
command_and_control_rdp_remote_desktop_protocol_from_the_internet.toml in rules/network	125	-	2020-06-30	2025-01-22	33	14	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
command_and_control_vnc_virtual_network_computing_from_the_internet.toml in rules/network	115	-	2020-06-30	2025-01-22	31	14	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
command_and_control_vnc_virtual_network_computing_to_the_internet.toml in rules/network	106	-	2020-06-30	2025-01-22	31	14	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
initial_access_rpc_remote_procedure_call_from_the_internet.toml in rules/network	97	-	2020-06-30	2025-01-22	31	14	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
initial_access_rpc_remote_procedure_call_to_the_internet.toml in rules/network	97	-	2020-06-30	2025-01-22	31	14	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
initial_access_smb_windows_file_sharing_activity_to_the_internet.toml in rules/network	108	-	2020-06-30	2025-01-22	31	14	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
privilege_escalation_uac_bypass_event_viewer.toml in rules/windows	151	-	2020-06-30	2025-02-19	53	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
persistence_priv_escalation_via_accessibility_features.toml in rules/windows	159	-	2020-06-30	2025-02-03	51	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
command_and_control_remote_file_copy_desktopimgdownldr.toml in rules/windows	160	-	2020-09-22	2025-02-19	51	13	64742097+samirbous@users.no...	26856693+w0rk3r@users.norep...
command_and_control_remote_file_copy_mpcmdrun.toml in rules/windows	158	-	2020-09-22	2025-02-19	51	13	64742097+samirbous@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_execution_msbuild_started_by_office_app.toml in rules/windows	127	-	2020-06-30	2025-02-19	48	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
execution_via_compiled_html_file.toml in rules/windows	155	-	2020-06-30	2025-02-19	47	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
persistence_via_update_orchestrator_service_hijack.toml in rules/windows	157	-	2020-09-29	2025-02-19	47	13	64742097+samirbous@users.no...	26856693+w0rk3r@users.norep...
lateral_movement_direct_outbound_smb_connection.toml in rules/windows	128	-	2020-06-30	2025-02-05	46	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
persistence_user_account_creation.toml in rules/windows	88	-	2020-06-30	2025-02-19	46	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
discovery_whoami_command_activity.toml in rules/windows	113	-	2020-06-30	2025-02-25	46	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
privilege_escalation_printspooler_suspicious_spl_file.toml in rules/windows	132	-	2020-09-29	2025-02-03	45	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
defense_evasion_execution_msbuild_started_by_system_process.toml in rules/windows	100	-	2020-06-30	2025-02-19	45	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
persistence_via_application_shimming.toml in rules/windows	108	-	2020-06-30	2025-02-19	44	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_execution_msbuild_started_renamed.toml in rules/windows	123	-	2020-06-30	2025-02-03	43	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_suspicious_zoom_child_process.toml in rules/windows	137	-	2020-09-30	2025-02-19	43	13	64742097+samirbous@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml in rules/windows	143	-	2020-06-30	2025-02-19	43	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_hidden_file_dir_tmp.toml in rules/linux	125	-	2020-06-30	2025-02-05	43	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
execution_register_server_program_connecting_to_the_internet.toml in rules/windows	148	-	2020-06-30	2025-02-03	42	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_masquerading_suspicious_werfault_childproc.toml in rules/windows	121	-	2020-09-22	2025-01-22	42	13	64742097+samirbous@users.no...	mikaayenson@users.noreply.g...
persistence_via_telemetrycontroller_scheduledtask_hijack.toml in rules/windows	121	-	2020-09-22	2025-02-19	41	13	64742097+samirbous@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_via_filter_manager.toml in rules/windows	131	-	2020-06-30	2025-02-25	41	13	31489089+rw-access@users.no...	64742097+samirbous@users.no...
defense_evasion_masquerading_as_elastic_endpoint_process.toml in rules/windows	112	-	2020-09-22	2025-02-19	41	13	64742097+samirbous@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_iis_httplogging_disabled.toml in rules/windows	92	-	2020-09-29	2025-02-19	40	13	64742097+samirbous@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_delete_volume_usn_journal_with_fsutil.toml in rules/windows	88	-	2020-06-30	2025-02-19	40	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
credential_access_iis_connectionstrings_dumping.toml in rules/windows	94	-	2020-09-29	2025-02-19	39	13	64742097+samirbous@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_execution_suspicious_explorer_winword.toml in rules/windows	100	-	2020-09-22	2025-03-14	38	13	64742097+samirbous@users.no...	64742097+samirbous@users.no...
execution_suspicious_psexesvc.toml in rules/windows	89	-	2020-10-20	2024-10-15	38	13	brokensound77@users.noreply...	26856693+w0rk3r@users.norep...
execution_command_shell_started_by_unusual_process.toml in rules/windows	94	-	2020-09-28	2025-01-22	38	13	64742097+samirbous@users.no...	mikaayenson@users.noreply.g...
defense_evasion_attempt_to_disable_iptables_or_firewall.toml in rules/linux	113	-	2020-06-30	2025-02-05	37	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
execution_suspicious_powershell_imgload.toml in rules/windows	103	-	2020-12-18	2024-09-25	34	13	brokensound77@users.noreply...	mikaayenson@users.noreply.g...
command_and_control_port_26_activity.toml in rules/network	77	-	2020-06-30	2025-01-22	32	13	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
defense_evasion_suspicious_wmi_script.toml in rules/windows	92	-	2020-10-20	2025-01-22	32	13	brokensound77@users.noreply...	mikaayenson@users.noreply.g...
command_and_control_nat_traversal_port_activity.toml in rules/network	67	-	2020-06-30	2025-01-22	30	13	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
command_and_control_download_rar_powershell_from_internet.toml in rules/network	111	-	2020-09-30	2025-01-22	27	13	7442091+peasead@users.norep...	mikaayenson@users.noreply.g...
ml_windows_anomalous_network_activity.toml in rules/ml	82	-	2020-06-30	2025-01-22	23	13	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...

Files With Least Contributors (Top 50)

Based on the number of unique email addresses found in commits.

See data for all files...

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
config.py in detection_rules	221	13	2024-08-06	2024-08-28	3	1	119343520+eric-forte-elasti...	119343520+eric-forte-elasti...
exception.py in detection_rules	199	10	2024-08-06	2024-08-06	1	1	119343520+eric-forte-elasti...	119343520+eric-forte-elasti...
persistence_via_systemd_timers.toml in hunting/linux/queries	180	-	2024-07-05	2024-07-05	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
__main__.py in hunting	161	7	2024-10-03	2024-10-03	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
lateral_movement_sns_topic_message_publish_by_rare_user.toml in rules/integrations/aws	142	-	2025-01-15	2025-01-15	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
credential_access_entra_password_spraying_non_interactive_sfa.toml in rules/integrations/azure	132	-	2025-03-11	2025-03-11	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
resource_development_sns_topic_created_by_rare_user.toml in rules/integrations/aws	130	-	2025-02-20	2025-02-20	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
persistence_web_server_sus_command_execution.toml in rules/linux	129	-	2025-03-06	2025-03-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
impact_s3_unusual_object_encryption_with_sse_c.toml in rules/integrations/aws	126	-	2025-01-15	2025-01-15	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
generic_loader.py in detection_rules	125	18	2024-08-06	2024-08-06	1	1	119343520+eric-forte-elasti...	119343520+eric-forte-elasti...
persistence_web_server_sus_child_spawned.toml in rules/linux	124	-	2025-03-06	2025-03-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
action_connector.py in detection_rules	124	6	2024-08-06	2024-08-06	1	1	119343520+eric-forte-elasti...	119343520+eric-forte-elasti...
search.py in hunting	124	10	2024-10-03	2024-10-03	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
execution_process_backgrounded_by_unusual_parent.toml in rules/linux	123	-	2025-02-03	2025-02-03	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
credential_access_collection_sensitive_files_compression_inside_a_container.toml in rules/_deprecated	121	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
persistence_web_server_sus_file_creation.toml in rules_building_block	121	-	2025-03-06	2025-03-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
persistence_pth_file_creation.toml in rules/linux	114	-	2025-03-03	2025-03-03	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
persistence_web_server_sus_destination_port.toml in rules/linux	114	-	2025-03-06	2025-03-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
persistence_iam_instance_request_to_iam_service.toml in rules_building_block	112	-	2024-11-06	2024-11-09	2	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
evaluator.py in lib/kql/kql	112	18	2024-03-15	2024-03-15	1	1	mikaayenson@users.noreply.g...	mikaayenson@users.noreply.g...
impact_potential_bruteforce_malware_infection.toml in rules/linux	109	-	2025-02-26	2025-02-26	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
defense_evasion_base64_decoding_activity.toml in rules/linux	109	-	2025-02-28	2025-02-28	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
persistence_site_and_user_customize_file_creation.toml in rules/linux	109	-	2025-03-03	2025-03-03	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
collection_onedrive_excessive_file_downloads.toml in rules/integrations/o365	107	-	2025-02-21	2025-02-21	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
discovery_suspicious_network_tool_launched_inside_a_container.toml in rules/_deprecated	107	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
impact_s3_excessive_object_encryption_with_sse_c.toml in rules/integrations/aws	104	-	2025-01-15	2025-01-15	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
execution_interactive_exec_to_container.toml in rules/_deprecated	104	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
initial_access_ssh_connection_established_inside_a_container.toml in rules/_deprecated	103	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
defense_evasion_interpreter_launched_from_decoded_payload.toml in rules/linux	103	-	2025-02-28	2025-02-28	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
persistence_ssh_authorized_keys_modification_inside_a_container.toml in rules/_deprecated	102	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
markdown.py in hunting	102	10	2024-10-03	2024-10-03	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
lateral_movement_ssh_process_launched_inside_a_container.toml in rules/_deprecated	101	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
persistence_bpf_probe_write_user.toml in rules/linux	101	-	2025-01-29	2025-01-29	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
defense_evasion_var_log_file_creation_by_unsual_process.toml in rules/linux	101	-	2025-03-12	2025-03-12	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
persistence_via_grub_bootloader.toml in hunting/linux/queries	101	-	2025-01-27	2025-01-27	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
initial_access_entra_rare_authentication_requirement_for_principal_user.toml in rules/integrations/azure	100	-	2025-03-11	2025-03-11	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
privilege_escalation_iam_update_assume_role_policy.toml in rules/integrations/aws	100	-	2025-01-31	2025-01-31	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
command_and_control_linux_port_knocking_reverse_connection.toml in rules/_deprecated	100	-	2024-03-07	2024-03-07	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
defense_evasion_outlook_suspicious_child.toml in rules_building_block	100	-	2025-01-15	2025-01-15	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
initial_access_entra_rare_app_id_for_principal_auth.toml in rules/integrations/azure	98	-	2025-03-11	2025-03-11	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
persistence_via_cron.toml in hunting/linux/queries	97	-	2024-07-05	2024-07-05	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
execution_suspicious_jar_child_process.toml in rules/_deprecated	96	-	2025-01-17	2025-01-17	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
defense_evasion_kill_command_executed.toml in rules/linux	96	-	2025-02-28	2025-02-28	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
execution_netcat_listener_established_inside_a_container.toml in rules/_deprecated	95	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_file_made_executable_via_chmod_inside_a_container.toml in rules/_deprecated	91	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
command_and_control_frequent_egress_netcon_from_sus_executable.toml in rules/linux	91	-	2025-02-26	2025-02-26	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
eql2kql.py in lib/kql/kql	91	16	2024-03-15	2024-03-15	1	1	mikaayenson@users.noreply.g...	mikaayenson@users.noreply.g...
optimizer.py in lib/kql/kql	91	13	2024-03-15	2024-03-15	1	1	mikaayenson@users.noreply.g...	mikaayenson@users.noreply.g...
ast.py in lib/kql/kql	91	11	2024-03-15	2024-03-15	1	1	mikaayenson@users.noreply.g...	mikaayenson@users.noreply.g...
credential_access_sensitive_keys_or_passwords_search_inside_a_container.toml in rules/_deprecated	90	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...