A temporal dependency occurs when developers change two or more files at the same time (i.e. they are a part of the same commit).
No file pairs changed together.
No temporal dependencies found.
No temporal dependencies found.
| Pairs | # same commits | # commits 1 | # commits 2 | latest commit |
|---|---|---|---|---|
| rules/windows/privilege_escalation_unquoted_service_path.toml rules/windows/execution_mofcomp.toml |
2 | 9 (22%) | 9 (22%) | 2025-02-19 |
| rules/windows/defense_evasion_audit_policy_disabled_winlog.toml rules/windows/credential_access_dollar_account_relay.toml |
2 | 4 (50%) | 7 (28%) | 2025-02-19 |
| detection_rules/main.py pyproject.toml |
2 | 56 (3%) | 70 (2%) | 2025-03-10 |
| rules/windows/lateral_movement_via_wsus_update.toml rules/windows/execution_mofcomp.toml |
2 | 9 (22%) | 9 (22%) | 2025-02-19 |
| rules/windows/lateral_movement_via_wsus_update.toml rules/windows/defense_evasion_windows_filtering_platform.toml |
2 | 9 (22%) | 11 (18%) | 2025-02-19 |
| rules/windows/lateral_movement_via_wsus_update.toml rules/windows/defense_evasion_audit_policy_disabled_winlog.toml |
2 | 9 (22%) | 4 (50%) | 2025-02-19 |
| rules/windows/execution_mofcomp.toml rules/windows/defense_evasion_windows_filtering_platform.toml |
2 | 9 (22%) | 11 (18%) | 2025-02-19 |
| rules/windows/privilege_escalation_unquoted_service_path.toml rules/windows/defense_evasion_audit_policy_disabled_winlog.toml |
2 | 9 (22%) | 4 (50%) | 2025-02-19 |
| rules/windows/defense_evasion_windows_filtering_platform.toml rules/windows/defense_evasion_lolbas_win_cdb_utility.toml |
2 | 11 (18%) | 6 (33%) | 2025-02-19 |
| rules/windows/discovery_whoami_command_activity.toml rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml |
2 | 54 (3%) | 27 (7%) | 2025-02-25 |
| rules/windows/execution_mofcomp.toml rules/windows/defense_evasion_audit_policy_disabled_winlog.toml |
2 | 9 (22%) | 4 (50%) | 2025-02-19 |
| rules/windows/defense_evasion_lolbas_win_cdb_utility.toml rules/windows/defense_evasion_audit_policy_disabled_winlog.toml |
2 | 6 (33%) | 4 (50%) | 2025-02-19 |
| rules/windows/privilege_escalation_unquoted_service_path.toml rules/windows/lateral_movement_via_wsus_update.toml |
2 | 9 (22%) | 9 (22%) | 2025-02-19 |
| rules/windows/privilege_escalation_unquoted_service_path.toml rules/windows/credential_access_dollar_account_relay.toml |
2 | 9 (22%) | 7 (28%) | 2025-02-19 |
| detection_rules/docs.py pyproject.toml |
2 | 22 (9%) | 70 (2%) | 2025-03-07 |
| rules/windows/defense_evasion_windows_filtering_platform.toml rules/windows/credential_access_dollar_account_relay.toml |
2 | 11 (18%) | 7 (28%) | 2025-02-19 |
| rules/windows/execution_mofcomp.toml rules/windows/defense_evasion_lolbas_win_cdb_utility.toml |
2 | 9 (22%) | 6 (33%) | 2025-02-19 |
| rules/windows/privilege_escalation_unquoted_service_path.toml rules/windows/defense_evasion_windows_filtering_platform.toml |
2 | 9 (22%) | 11 (18%) | 2025-02-19 |
| rules/windows/execution_mofcomp.toml rules/windows/credential_access_dollar_account_relay.toml |
2 | 9 (22%) | 7 (28%) | 2025-02-19 |
| rules/windows/defense_evasion_lolbas_win_cdb_utility.toml rules/windows/credential_access_dollar_account_relay.toml |
2 | 6 (33%) | 7 (28%) | 2025-02-19 |
| rules/windows/privilege_escalation_unquoted_service_path.toml rules/windows/defense_evasion_lolbas_win_cdb_utility.toml |
2 | 9 (22%) | 6 (33%) | 2025-02-19 |
| rules/windows/discovery_whoami_command_activity.toml rules/windows/command_and_control_tool_transfer_via_curl.toml |
2 | 54 (3%) | 3 (66%) | 2025-02-25 |
| rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml rules/windows/command_and_control_tool_transfer_via_curl.toml |
2 | 27 (7%) | 3 (66%) | 2025-02-25 |
| rules/windows/lateral_movement_via_wsus_update.toml rules/windows/defense_evasion_lolbas_win_cdb_utility.toml |
2 | 9 (22%) | 6 (33%) | 2025-02-19 |
| detection_rules/custom_rules.py pyproject.toml |
2 | 3 (66%) | 70 (2%) | 2025-03-10 |
| rules/windows/defense_evasion_windows_filtering_platform.toml rules/windows/defense_evasion_audit_policy_disabled_winlog.toml |
2 | 11 (18%) | 4 (50%) | 2025-02-19 |
| rules/windows/lateral_movement_via_wsus_update.toml rules/windows/credential_access_dollar_account_relay.toml |
2 | 9 (22%) | 7 (28%) | 2025-02-19 |
| rules/windows/initial_access_suspicious_ms_office_child_process.toml rules/windows/execution_enumeration_via_wmiprvse.toml |
1 | 47 (2%) | 34 (2%) | 2025-02-19 |
| rules/windows/persistence_msds_alloweddelegateto_krbtgt.toml rules/windows/execution_apt_solarwinds_backdoor_child_cmd_powershell.toml |
1 | 22 (4%) | 36 (2%) | 2025-02-19 |
| rules/windows/execution_initial_access_foxmail_exploit.toml rules/windows/discovery_admin_recon.toml |
1 | 6 (16%) | 45 (2%) | 2025-02-19 |
| rules/windows/credential_access_ldap_attributes.toml rules/windows/command_and_control_dns_tunneling_nslookup.toml |
1 | 23 (4%) | 34 (2%) | 2025-02-19 |
| rules/windows/credential_access_lsass_memdump_handle_access.toml rules/windows/defense_evasion_via_filter_manager.toml |
1 | 36 (2%) | 46 (2%) | 2025-02-19 |
| rules/windows/privilege_escalation_make_token_local.toml rules/windows/execution_suspicious_pdf_reader.toml |
1 | 11 (9%) | 55 (1%) | 2025-02-19 |
| rules/windows/credential_access_lsass_memdump_handle_access.toml rules/windows/lateral_movement_remote_file_copy_hidden_share.toml |
1 | 36 (2%) | 38 (2%) | 2025-02-19 |
| rules/windows/lateral_movement_remote_task_creation_winlog.toml rules/windows/defense_evasion_enable_inbound_rdp_with_netsh.toml |
1 | 20 (5%) | 42 (2%) | 2025-02-19 |
| rules/windows/defense_evasion_iis_httplogging_disabled.toml rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml |
1 | 45 (2%) | 12 (8%) | 2025-02-19 |
| rules/windows/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml rules/windows/credential_access_wireless_creds_dumping.toml |
1 | 34 (2%) | 19 (5%) | 2025-02-19 |
| rules/windows/credential_access_dcsync_replication_rights.toml rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml |
1 | 39 (2%) | 12 (8%) | 2025-02-19 |
| rules/windows/defense_evasion_execution_msbuild_started_by_system_process.toml rules/windows/credential_access_dnsnode_creation.toml |
1 | 52 (1%) | 10 (10%) | 2025-02-19 |
| rules/windows/persistence_remote_password_reset.toml rules/windows/defense_evasion_powershell_windows_firewall_disabled.toml |
1 | 30 (3%) | 33 (3%) | 2025-02-19 |
| rules/windows/privilege_escalation_newcreds_logon_rare_process.toml rules/windows/credential_access_wireless_creds_dumping.toml |
1 | 10 (10%) | 19 (5%) | 2025-02-19 |
| rules/windows/privilege_escalation_group_policy_iniscript.toml rules/windows/defense_evasion_workfolders_control_execution.toml |
1 | 29 (3%) | 29 (3%) | 2025-02-19 |
| rules/windows/execution_via_compiled_html_file.toml rules/windows/discovery_enumerating_domain_trusts_via_dsquery.toml |
1 | 52 (1%) | 18 (5%) | 2025-02-19 |
| rules/windows/privilege_escalation_krbrelayup_service_creation.toml rules/windows/collection_email_powershell_exchange_mailbox.toml |
1 | 15 (6%) | 49 (2%) | 2025-02-19 |
| rules/windows/privilege_escalation_tokenmanip_sedebugpriv_enabled.toml rules/windows/impact_stop_process_service_threshold.toml |
1 | 15 (6%) | 28 (3%) | 2025-02-19 |
| rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml rules/windows/initial_access_rdp_file_mail_attachment.toml |
1 | 37 (2%) | 3 (33%) | 2025-02-19 |
| rules/windows/privilege_escalation_suspicious_dnshostname_update.toml rules/windows/privilege_escalation_group_policy_iniscript.toml |
1 | 18 (5%) | 29 (3%) | 2025-02-19 |
| rules/windows/persistence_system_shells_via_services.toml rules/windows/lateral_movement_execution_from_tsclient_mup.toml |
1 | 59 (1%) | 36 (2%) | 2025-02-19 |
| rules/windows/privilege_escalation_uac_bypass_mock_windir.toml rules/windows/defense_evasion_execution_lolbas_wuauclt.toml |
1 | 50 (2%) | 39 (2%) | 2025-02-19 |
| rules/windows/persistence_scheduled_task_creation_winlog.toml rules/windows/lateral_movement_remote_file_copy_hidden_share.toml |
1 | 16 (6%) | 38 (2%) | 2025-02-19 |
| Pairs | # same commits | # commits 1 | # commits 2 | latest commit |
|---|---|---|---|---|
| rules/integrations/github/execution_new_github_app_installed.toml rules/integrations/github/defense_evasion_github_protected_branch_settings_changed.toml |
4 | 9 (44%) | 9 (44%) | 2025-01-22 |
| rules/integrations/github/persistence_organization_owner_role_granted.toml rules/integrations/github/execution_github_app_deleted.toml |
4 | 10 (40%) | 8 (50%) | 2025-01-22 |
| rules/integrations/github/persistence_github_org_owner_added.toml rules/integrations/github/execution_github_high_number_of_cloned_repos_from_pat.toml |
4 | 10 (40%) | 8 (50%) | 2025-01-22 |
| rules/integrations/github/persistence_github_org_owner_added.toml rules/integrations/github/impact_github_repository_deleted.toml |
4 | 10 (40%) | 11 (36%) | 2025-01-22 |
| rules/integrations/github/persistence_organization_owner_role_granted.toml rules/integrations/github/defense_evasion_github_protected_branch_settings_changed.toml |
4 | 10 (40%) | 9 (44%) | 2025-01-22 |
| rules/integrations/github/impact_github_repository_deleted.toml rules/integrations/github/execution_github_high_number_of_cloned_repos_from_pat.toml |
4 | 11 (36%) | 8 (50%) | 2025-01-22 |
| rules/linux/persistence_insmod_kernel_module_load.toml rules/linux/persistence_dynamic_linker_backup.toml |
4 | 26 (15%) | 22 (18%) | 2025-02-05 |
| rules/integrations/github/execution_github_high_number_of_cloned_repos_from_pat.toml rules/integrations/github/execution_github_app_deleted.toml |
4 | 8 (50%) | 8 (50%) | 2025-01-22 |
| rules/linux/persistence_kde_autostart_modification.toml rules/linux/command_and_control_linux_ssh_x11_forwarding.toml |
4 | 34 (11%) | 5 (80%) | 2025-02-05 |
| rules/integrations/github/execution_github_high_number_of_cloned_repos_from_pat.toml rules/integrations/github/defense_evasion_github_protected_branch_settings_changed.toml |
4 | 8 (50%) | 9 (44%) | 2025-01-22 |
| rules/linux/persistence_kworker_file_creation.toml rules/linux/persistence_kde_autostart_modification.toml |
4 | 15 (26%) | 34 (11%) | 2025-02-05 |
| rules/integrations/github/execution_github_app_deleted.toml rules/integrations/github/defense_evasion_github_protected_branch_settings_changed.toml |
4 | 8 (50%) | 9 (44%) | 2025-01-22 |
| rules/linux/persistence_kde_autostart_modification.toml rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml |
4 | 34 (11%) | 19 (21%) | 2025-02-05 |
| rules/linux/persistence_kworker_file_creation.toml rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml |
4 | 15 (26%) | 19 (21%) | 2025-02-05 |
| rules/integrations/github/persistence_github_org_owner_added.toml rules/integrations/github/execution_new_github_app_installed.toml |
4 | 10 (40%) | 9 (44%) | 2025-01-22 |
| rules/linux/persistence_kworker_file_creation.toml rules/linux/command_and_control_linux_proxychains_activity.toml |
4 | 15 (26%) | 9 (44%) | 2025-02-05 |
| rules/linux/persistence_setuid_setgid_capability_set.toml rules/linux/persistence_linux_user_added_to_privileged_group.toml |
4 | 18 (22%) | 24 (16%) | 2025-02-05 |
| rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml rules/linux/command_and_control_linux_ssh_x11_forwarding.toml |
4 | 19 (21%) | 5 (80%) | 2025-02-05 |
| rules/integrations/github/impact_github_repository_deleted.toml rules/integrations/github/execution_github_app_deleted.toml |
4 | 11 (36%) | 8 (50%) | 2025-01-22 |
| rules/linux/persistence_kworker_file_creation.toml rules/linux/command_and_control_linux_ssh_x11_forwarding.toml |
4 | 15 (26%) | 5 (80%) | 2025-02-05 |
| rules/integrations/github/impact_github_repository_deleted.toml rules/integrations/github/defense_evasion_github_protected_branch_settings_changed.toml |
4 | 11 (36%) | 9 (44%) | 2025-01-22 |
| rules/integrations/github/persistence_organization_owner_role_granted.toml rules/integrations/github/execution_new_github_app_installed.toml |
4 | 10 (40%) | 9 (44%) | 2025-01-22 |
| rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml rules/linux/command_and_control_linux_proxychains_activity.toml |
4 | 19 (21%) | 9 (44%) | 2025-02-05 |
| rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml rules/linux/defense_evasion_acl_modification_via_setfacl.toml |
4 | 44 (9%) | 5 (80%) | 2025-02-05 |
| rules/integrations/github/persistence_organization_owner_role_granted.toml rules/integrations/github/execution_github_high_number_of_cloned_repos_from_pat.toml |
4 | 10 (40%) | 8 (50%) | 2025-01-22 |
| rules/linux/command_and_control_linux_ssh_x11_forwarding.toml rules/linux/command_and_control_linux_proxychains_activity.toml |
4 | 5 (80%) | 9 (44%) | 2025-02-05 |
| rules/integrations/okta/persistence_stolen_credentials_used_to_login_to_okta_account_after_mfa_reset.toml rules/integrations/okta/initial_access_first_occurrence_user_session_started_via_proxy.toml |
4 | 12 (33%) | 12 (33%) | 2025-02-20 |
| rules/linux/impact_memory_swap_modification.toml rules/linux/exfiltration_potential_data_splitting_for_exfiltration.toml |
4 | 5 (80%) | 5 (80%) | 2025-02-05 |
| rules/integrations/github/execution_new_github_app_installed.toml rules/integrations/github/execution_github_high_number_of_cloned_repos_from_pat.toml |
4 | 9 (44%) | 8 (50%) | 2025-01-22 |
| rules/integrations/github/persistence_github_org_owner_added.toml rules/integrations/github/defense_evasion_github_protected_branch_settings_changed.toml |
4 | 10 (40%) | 9 (44%) | 2025-01-22 |
| rules/integrations/github/persistence_github_org_owner_added.toml rules/integrations/github/execution_github_app_deleted.toml |
4 | 10 (40%) | 8 (50%) | 2025-01-22 |
| rules/integrations/github/execution_new_github_app_installed.toml rules/integrations/github/execution_github_app_deleted.toml |
4 | 9 (44%) | 8 (50%) | 2025-01-22 |
| rules/integrations/github/persistence_organization_owner_role_granted.toml rules/integrations/github/impact_github_repository_deleted.toml |
4 | 10 (40%) | 11 (36%) | 2025-01-22 |
| rules/linux/persistence_kde_autostart_modification.toml rules/linux/command_and_control_linux_proxychains_activity.toml |
4 | 34 (11%) | 9 (44%) | 2025-02-05 |
| rules/linux/execution_shell_openssl_client_or_server.toml rules/linux/execution_unix_socket_communication.toml |
4 | 6 (66%) | 6 (66%) | 2025-02-05 |
| rules/integrations/github/impact_github_repository_deleted.toml rules/integrations/github/execution_new_github_app_installed.toml |
4 | 11 (36%) | 9 (44%) | 2025-01-22 |
| rules/integrations/github/persistence_organization_owner_role_granted.toml rules/integrations/github/persistence_github_org_owner_added.toml |
4 | 10 (40%) | 10 (40%) | 2025-01-22 |
| rules/linux/persistence_kde_autostart_modification.toml rules/linux/persistence_etc_file_creation.toml |
4 | 34 (11%) | 33 (12%) | 2025-02-05 |
| detection_rules/devtools.py pyproject.toml |
4 | 99 (4%) | 70 (5%) | 2025-03-07 |
| rules/integrations/okta/defense_evasion_attempt_to_delete_okta_network_zone.toml rules/integrations/github/persistence_github_org_owner_added.toml |
3 | 18 (16%) | 10 (30%) | 2025-01-22 |
| rules/integrations/okta/initial_access_suspicious_activity_reported_by_okta_user.toml rules/integrations/okta/defense_evasion_attempt_to_deactivate_okta_network_zone.toml |
3 | 17 (17%) | 18 (16%) | 2025-01-22 |
| rules/integrations/okta/persistence_administrator_role_assigned_to_okta_user.toml rules/integrations/github/persistence_organization_owner_role_granted.toml |
3 | 17 (17%) | 10 (30%) | 2025-01-22 |
| rules/integrations/okta/persistence_mfa_deactivation_with_no_reactivation.toml rules/integrations/github/execution_github_app_deleted.toml |
3 | 12 (25%) | 8 (37%) | 2025-01-22 |
| rules/integrations/okta/credential_access_okta_potentially_successful_okta_bombing_via_push_notifications.toml rules/integrations/github/execution_new_github_app_installed.toml |
3 | 11 (27%) | 9 (33%) | 2025-01-22 |
| rules/integrations/okta/initial_access_suspicious_activity_reported_by_okta_user.toml rules/integrations/okta/credential_access_user_impersonation_access.toml |
3 | 17 (17%) | 21 (14%) | 2025-01-22 |
| rules/integrations/okta/persistence_attempt_to_create_okta_api_token.toml rules/integrations/github/execution_github_app_deleted.toml |
3 | 17 (17%) | 8 (37%) | 2025-01-22 |
| rules/integrations/okta/okta_threatinsight_threat_suspected_promotion.toml rules/integrations/okta/credential_access_okta_brute_force_or_password_spraying.toml |
3 | 13 (23%) | 22 (13%) | 2025-01-22 |
| rules/linux/defense_evasion_hidden_shared_object.toml rules/linux/defense_evasion_dynamic_linker_file_creation.toml |
3 | 21 (14%) | 5 (60%) | 2025-02-05 |
| rules/integrations/endpoint/impact_elastic_ransomware_prevented.toml rules/integrations/endpoint/defense_evasion_elastic_memory_threat_prevented.toml |
3 | 3 (100%) | 3 (100%) | 2025-02-07 |
| rules/integrations/okta/persistence_attempt_to_create_okta_api_token.toml rules/integrations/okta/initial_access_new_authentication_behavior_detection.toml |
3 | 17 (17%) | 11 (27%) | 2025-01-22 |
