elastic / detection-rules - File Age & Freshness

File age measurements show the distribution of file ages (days since the first commit) and the file freshness (days since the latest commit).

Summary

Number of files: 1,718
Daily file updates (only one update per file and date counted): 3906
First update: 2020-06-30
Latest update: 2025-05-10
Days between first and latest update: 1,776 (253 weeks, estimated 1,265 working days)
Active days (at least one file change): 817
Data:

Organized per file

File Change History Overall

File Age Distribution Overall

Days since first update

There are 1,718 files with 169,942 lines of code in files.

1,179 files that are 366+ days old (122,180 lines of code)
284 files that are 181-365 days old (23,549 lines of code)
83 files that are 91-180 days old (8,956 lines of code)
100 files that are 31-90 days old (9,565 lines of code)
72 files that are 1-30 days old (5,692 lines of code)

Legend:

366+

181-365

91-180

31-90

1-30

explore: grouped by folders | grouped by age

File Freshness Distribution Overall

Days since last update

There are 1,718 files with 169,942 lines of code in files.

89 files have been last changed 366+ days ago (5,470 lines of code)
217 files have been last changed 181-365 days ago (14,678 lines of code)
518 files have been last changed 91-180 days ago (51,238 lines of code)
697 files have been last changed 31-90 days ago (74,312 lines of code)
197 files have been last changed 1-30 days ago (24,244 lines of code)

Legend:

366+

181-365

91-180

31-90

1-30

explore: grouped by folders | grouped by freshness

File Change History per File Extension

toml, json, md, py, yaml, txt, bash, sh, svg, gitignore, g

File Age Distribution per Extension

Days since first update

366+

181-365

91-180

31-90

1-30

File Freshness Distribution per Extension

Days since last update

366+

181-365

91-180

31-90

1-30

File Change History per Logical Decomposition

primary

primary (file age distribution)

Days since first update

366+

181-365

91-180

31-90

1-30

primary (file freshness distribution)

Days since last update

366+

181-365

91-180

31-90

1-30

Oldest Files (Top 50)

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
rule.py in detection_rules	1152	114	2020-06-30	2025-04-28	122	12	31489089+rw-access@users.no...	traut@users.noreply.github.com
main.py in detection_rules	535	18	2020-06-30	2025-04-16	49	11	31489089+rw-access@users.no...	119343520+eric-forte-elasti...
rule_loader.py in detection_rules	451	44	2020-06-30	2025-04-30	38	8	31489089+rw-access@users.no...	traut@users.noreply.github.com
packaging.py in detection_rules	367	18	2020-06-30	2025-04-28	55	11	31489089+rw-access@users.no...	traut@users.noreply.github.com
utils.py in detection_rules	339	44	2020-06-30	2025-05-06	38	6	31489089+rw-access@users.no...	119343520+eric-forte-elasti...
misc.py in detection_rules	312	17	2020-06-30	2025-03-24	41	8	31489089+rw-access@users.no...	traut@users.noreply.github.com
eswrap.py in detection_rules	306	22	2020-06-30	2025-05-02	31	8	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
ecs.py in detection_rules	245	21	2020-06-30	2024-11-13	19	7	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
rule_formatter.py in detection_rules	200	10	2020-06-30	2025-01-22	18	7	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
beats.py in detection_rules	184	17	2020-06-30	2024-11-13	20	10	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
attack.py in detection_rules	164	10	2020-06-30	2024-05-23	14	6	31489089+rw-access@users.no...	119343520+eric-forte-elasti...
persistence_priv_escalation_via_accessibility_features.toml in rules/windows	163	-	2020-06-30	2025-03-26	52	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
privilege_escalation_unusual_parentchild_relationship.toml in rules/windows	156	-	2020-06-30	2025-03-26	56	14	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
execution_via_compiled_html_file.toml in rules/windows	153	-	2020-06-30	2025-03-26	48	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
execution_command_shell_started_by_svchost.toml in rules/windows	152	-	2020-06-30	2025-03-26	52	15	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
privilege_escalation_uac_bypass_event_viewer.toml in rules/windows	149	-	2020-06-30	2025-03-26	54	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
execution_register_server_program_connecting_to_the_internet.toml in rules/windows	146	-	2020-06-30	2025-03-26	43	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
execution_html_help_executable_program_connecting_to_the_internet.toml in rules/windows	146	-	2020-06-30	2025-03-26	37	11	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml in rules/windows	141	-	2020-06-30	2025-03-26	44	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
credential_access_credential_dumping_msbuild.toml in rules/windows	141	-	2020-06-30	2025-03-26	44	12	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
execution_command_prompt_connecting_to_the_internet.toml in rules/windows	140	-	2020-06-30	2025-03-26	34	10	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
persistence_system_shells_via_services.toml in rules/windows	133	-	2020-06-30	2025-03-26	52	14	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
persistence_adobe_hijack_persistence.toml in rules/windows	130	-	2020-06-30	2025-03-26	53	12	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_via_filter_manager.toml in rules/windows	129	-	2020-06-30	2025-03-26	42	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_kernel_module_removal.toml in rules/linux	129	-	2020-06-30	2025-03-20	40	12	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
lateral_movement_direct_outbound_smb_connection.toml in rules/windows	128	-	2020-06-30	2025-02-05	46	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_execution_msbuild_started_renamed.toml in rules/windows	127	-	2020-06-30	2025-05-05	45	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
command_and_control_rdp_remote_desktop_protocol_from_the_internet.toml in rules/network	125	-	2020-06-30	2025-01-22	33	14	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
defense_evasion_execution_msbuild_started_by_office_app.toml in rules/windows	125	-	2020-06-30	2025-03-26	49	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_hidden_file_dir_tmp.toml in rules/linux	125	-	2020-06-30	2025-02-05	43	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
execution_suspicious_pdf_reader.toml in rules/windows	123	-	2020-06-30	2025-03-26	46	12	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_misc_lolbin_connecting_to_the_internet.toml in rules/windows	123	-	2020-06-30	2025-03-26	39	12	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml in rules/linux	120	-	2020-06-30	2025-03-20	37	12	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
lateral_movement_telnet_network_activity_internal.toml in rules/linux	117	-	2020-06-30	2025-03-20	33	12	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_attempt_to_disable_syslog_service.toml in rules/linux	117	-	2020-06-30	2025-03-20	39	12	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
lateral_movement_telnet_network_activity_external.toml in rules/linux	116	-	2020-06-30	2025-03-20	33	12	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_disable_selinux_attempt.toml in rules/linux	116	-	2020-06-30	2025-03-20	38	12	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
command_and_control_vnc_virtual_network_computing_from_the_internet.toml in rules/network	115	-	2020-06-30	2025-05-05	32	14	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
discovery_kernel_module_enumeration.toml in rules/linux	114	-	2020-06-30	2025-01-29	38	12	31489089+rw-access@users.no...	78494512+aegrah@users.norep...
defense_evasion_file_mod_writable_dir.toml in rules/linux	114	-	2020-06-30	2025-01-29	35	12	31489089+rw-access@users.no...	78494512+aegrah@users.norep...
discovery_virtual_machine_fingerprinting.toml in rules/linux	113	-	2020-06-30	2025-01-22	30	11	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
discovery_whoami_command_activity.toml in rules/windows	111	-	2020-06-30	2025-03-26	47	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_attempt_to_disable_iptables_or_firewall.toml in rules/linux	111	-	2020-06-30	2025-03-20	38	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
execution_psexec_lateral_movement_command.toml in rules/windows	109	-	2020-06-30	2025-03-26	38	12	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
initial_access_smb_windows_file_sharing_activity_to_the_internet.toml in rules/network	108	-	2020-06-30	2025-01-22	31	14	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
command_and_control_vnc_virtual_network_computing_to_the_internet.toml in rules/network	106	-	2020-06-30	2025-05-05	32	14	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
persistence_via_application_shimming.toml in rules/windows	106	-	2020-06-30	2025-03-26	45	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_execution_msbuild_started_by_script.toml in rules/windows	106	-	2020-06-30	2025-03-26	44	14	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_clearing_windows_event_logs.toml in rules/windows	103	-	2020-06-30	2025-03-26	51	16	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_execution_msbuild_started_unusal_process.toml in rules/windows	103	-	2020-06-30	2025-03-26	43	14	31489089+rw-access@users.no...	91139415+shashank-elastic@u...

Files Not Recently Changed (Top 50)

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
privilege_escalation_setgid_bit_set_via_chmod.toml in rules/_deprecated	48	-	2021-03-17	2021-03-17	1	1	brokensound77@users.noreply...	brokensound77@users.noreply...
execution_via_net_com_assemblies.toml in rules/_deprecated	46	-	2021-03-19	2021-03-19	1	1	64742097+samirbous@users.no...	64742097+samirbous@users.no...
discovery_process_discovery_via_tasklist_command.toml in rules/_deprecated	39	-	2021-04-15	2021-04-15	1	1	64742097+samirbous@users.no...	64742097+samirbous@users.no...
defense_evasion_execution_via_trusted_developer_utilities.toml in rules/_deprecated	39	-	2021-04-15	2021-04-15	1	1	64742097+samirbous@users.no...	64742097+samirbous@users.no...
linux_socat_activity.toml in rules/_deprecated	33	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
linux_mknod_activity.toml in rules/_deprecated	34	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
linux_nmap_activity.toml in rules/_deprecated	34	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
discovery_query_registry_via_reg.toml in rules/_deprecated	37	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
execution_command_shell_started_by_powershell.toml in rules/_deprecated	37	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
command_and_control_pptp_point_to_point_tunneling_protocol_activity.toml in rules/_deprecated	40	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
discovery_whoami_commmand.toml in rules/_deprecated	41	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
defense_evasion_hex_encoding_or_decoding_activity.toml in rules/_deprecated	42	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
defense_evasion_base64_encoding_or_decoding_activity.toml in rules/_deprecated	43	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
persistence_kernel_module_activity.toml in rules/_deprecated	45	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
persistence_cron_jobs_creation_and_runtime.toml in rules/_deprecated	50	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
credential_access_tcpdump_activity.toml in rules/_deprecated	52	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
command_and_control_sql_server_port_activity_to_the_internet.toml in rules/_deprecated	56	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
command_and_control_port_8000_activity_to_the_internet.toml in rules/_deprecated	57	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
command_and_control_proxy_port_activity_to_the_internet.toml in rules/_deprecated	60	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
command_and_control_tor_activity_to_the_internet.toml in rules/_deprecated	60	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
command_and_control_smtp_to_the_internet.toml in rules/_deprecated	65	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
command_and_control_irc_internet_relay_chat_protocol_activity_to_the_internet.toml in rules/_deprecated	68	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
command_and_control_ftp_file_transfer_protocol_activity_to_the_internet.toml in rules/_deprecated	69	-	2021-04-21	2021-04-21	1	1	56412096+bm11100@users.nore...	56412096+bm11100@users.nore...
command_and_control_ssh_secure_shell_to_the_internet.toml in rules/_deprecated	58	-	2021-04-21	2021-07-29	2	2	56412096+bm11100@users.nore...	brokensound77@users.noreply...
initial_access_rdp_remote_desktop_protocol_to_the_internet.toml in rules/_deprecated	72	-	2021-04-21	2021-07-29	2	2	56412096+bm11100@users.nore...	brokensound77@users.noreply...
command_and_control_ssh_secure_shell_from_the_internet.toml in rules/_deprecated	79	-	2021-04-21	2021-07-29	2	2	56412096+bm11100@users.nore...	brokensound77@users.noreply...
defense_evasion_mshta_making_network_connections.toml in rules/_deprecated	42	-	2021-10-20	2021-10-20	1	1	brokensound77@users.noreply...	brokensound77@users.noreply...
exfiltration_rds_snapshot_export.toml in rules/_deprecated	40	-	2021-10-26	2021-10-26	1	1	brokensound77@users.noreply...	brokensound77@users.noreply...
privilege_escalation_printspooler_malicious_driver_file_changes.toml in rules/_deprecated	43	-	2022-03-17	2022-03-17	1	1	jonhnathancesar@gmail.com	jonhnathancesar@gmail.com
privilege_escalation_printspooler_malicious_registry_modification.toml in rules/_deprecated	43	-	2022-03-17	2022-03-17	1	1	jonhnathancesar@gmail.com	jonhnathancesar@gmail.com
execution_flock_binary.toml in rules/_deprecated	42	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_vi_binary.toml in rules/_deprecated	42	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_env_binary.toml in rules/_deprecated	42	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_busybox_binary.toml in rules/_deprecated	42	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_crash_binary.toml in rules/_deprecated	42	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_awk_binary_shell.toml in rules/_deprecated	43	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_mysql_binary.toml in rules/_deprecated	44	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_gcc_binary.toml in rules/_deprecated	44	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_c89_c99_binary.toml in rules/_deprecated	44	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_expect_binary.toml in rules/_deprecated	44	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_find_binary.toml in rules/_deprecated	44	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_cpulimit_binary.toml in rules/_deprecated	45	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_apt_binary.toml in rules/_deprecated	45	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_ssh_binary.toml in rules/_deprecated	45	-	2022-05-25	2022-05-25	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_linux_process_started_in_temp_directory.toml in rules/_deprecated	42	-	2022-07-26	2022-07-26	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
defense_evasion_attempt_to_disable_iptables_or_firewall.toml in rules/_deprecated	44	-	2022-07-26	2022-07-26	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
initial_access_login_time.toml in rules/_deprecated	44	-	2022-07-26	2022-07-26	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
initial_access_login_sessions.toml in rules/_deprecated	44	-	2022-07-26	2022-07-26	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
initial_access_login_location.toml in rules/_deprecated	44	-	2022-07-26	2022-07-26	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
initial_access_login_failures.toml in rules/_deprecated	44	-	2022-07-26	2022-07-26	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...

Most Recently Created Files (Top 50)

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
initial_access_entra_graph_single_session_from_multiple_addresses.toml in rules/integrations/azure	154	-	2025-05-10	2025-05-10	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
collection_graph_email_access_by_unusual_public_client_via_graph.toml in rules/integrations/azure	105	-	2025-05-10	2025-05-10	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
entra_suspicious_odata_client_requests.toml in hunting/azure/queries	59	-	2025-05-10	2025-05-10	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
persistence_exchange_suspicious_mailbox_permission_delegation.toml in rules/integrations/o365	121	-	2025-05-08	2025-05-08	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
defense_evasion_hex_payload_execution_via_utility.toml in rules/linux	133	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
defense_evasion_entra_suspicious_auth_broker_activity_on_behalf_of_principal_user.toml in rules/integrations/azure	128	-	2025-05-06	2025-05-06	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
defense_evasion_ld_preload_cmdline.toml in rules/linux	109	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
persistence_entra_service_principal_created.toml in rules/integrations/azure	103	-	2025-05-06	2025-05-06	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
initial_access_azure_o365_with_network_alert.toml in rules/cross-platform	98	-	2025-05-06	2025-05-06	1	1	64742097+samirbous@users.no...	64742097+samirbous@users.no...
defense_evasion_hex_payload_execution_via_commandline.toml in rules/linux	92	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
execution_unusual_kthreadd_execution.toml in rules/linux	91	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
defense_evasion_posh_obfuscation_proportion_special_chars.toml in rules_building_block	90	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
defense_evasion_microsoft_365_susp_oauth2_authorization.toml in rules/integrations/o365	89	-	2025-05-06	2025-05-06	1	1	64742097+samirbous@users.no...	64742097+samirbous@users.no...
credential_access_azure_entra_suspicious_signin.toml in rules/integrations/azure	88	-	2025-05-06	2025-05-06	1	1	64742097+samirbous@users.no...	64742097+samirbous@users.no...
defense_evasion_posh_obfuscation_index_reversal.toml in rules/windows	88	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
defense_evasion_posh_obfuscation_high_number_proportion.toml in rules/windows	87	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
defense_evasion_posh_obfuscation_char_arrays.toml in rules/windows	87	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
defense_evasion_posh_obfuscation_whitespace_special_proportion.toml in rules/windows	87	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
execution_suspicious_mkfifo_execution.toml in rules/linux	87	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
defense_evasion_posh_obfuscation_backtick.toml in rules/windows	85	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
defense_evasion_posh_obfuscation_iex_env_vars_reconstruction.toml in rules/windows	85	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
defense_evasion_posh_obfuscation_backtick_var.toml in rules/windows	85	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
defense_evasion_posh_obfuscation_reverse_keyword.toml in rules/windows	85	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
defense_evasion_posh_obfuscation_string_concat.toml in rules/windows	84	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
defense_evasion_posh_obfuscation_concat_dynamic.toml in rules/windows	82	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
credential_access_manual_memory_dumping.toml in rules/linux	81	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
defense_evasion_sysctl_kernel_feature_activity.toml in rules/linux	81	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
exfiltration_potential_curl_data_exfiltration.toml in rules/linux	80	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
command_and_control_telegram_api_request.toml in rules/linux	79	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
command_and_control_git_repo_or_file_download_to_sus_dir.toml in rules/linux	79	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
discovery_manual_mount_discovery_via_exports_or_fstab.toml in rules/linux	72	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
defense_evasion_symlink_binary_to_writable_dir.toml in rules/linux	70	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
persistence_pluggable_authentication_module_pam_exec_backdoor_exec.toml in rules/linux	70	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
credential_access_rare_webdav_destination.toml in rules/windows	68	-	2025-05-06	2025-05-06	1	1	64742097+samirbous@users.no...	64742097+samirbous@users.no...
defense_evasion_suspicious_path_mounted.toml in rules/linux	68	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
defense_evasion_run_virt_windowssandbox.toml in rules/windows	65	-	2025-05-06	2025-05-06	1	1	64742097+samirbous@users.no...	64742097+samirbous@users.no...
persistence_unusual_exim4_child_process.toml in rules/linux	59	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
privilege_escalation_docker_release_file_creation.toml in rules/linux	46	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
collection_entra_auth_broker_sharepoint_access_for_user_principal.toml in rules/integrations/azure	111	-	2025-05-05	2025-05-07	2	2	99630311+terrancedejesus@us...	91139415+shashank-elastic@u...
command_and_control_linux_tunneling_via_ssh_option.toml in rules/linux	80	-	2025-05-05	2025-05-05	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
initial_access_graph_first_occurrence_of_client_request.toml in rules/integrations/azure	110	-	2025-05-02	2025-05-02	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
initial_access_entra_oauth_phishing_via_vscode_client.toml in rules/integrations/azure	104	-	2025-05-02	2025-05-02	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
initial_access_microsoft_365_entra_oauth_phishing_via_vscode_client.toml in rules/integrations/o365	101	-	2025-05-02	2025-05-02	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
credential_access_antra_id_device_reg_via_oauth_redirection.toml in rules/integrations/o365	91	-	2025-05-02	2025-05-02	1	1	64742097+samirbous@users.no...	64742097+samirbous@users.no...
command_and_control_entra_protection_anonymized_ip_reported.toml in rules/integrations/azure	88	-	2025-05-02	2025-05-02	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
initial_access_entra_protection_multi_azure_identity_protection_alerts.toml in rules/integrations/azure	86	-	2025-05-02	2025-05-02	1	1	64742097+samirbous@users.no...	64742097+samirbous@users.no...
impact_s3_static_site_js_file_uploaded.toml in rules/integrations/aws	110	-	2025-04-30	2025-04-30	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
persistence_iam_api_calls_via_user_session_token.toml in rules/integrations/aws	87	-	2025-04-24	2025-04-24	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
defense_evasion_self_deleted_python_script_outbound_network_connection.toml in hunting/macos/queries	36	-	2025-04-24	2025-04-24	1	1	48036388+defsecsentinel@use...	48036388+defsecsentinel@use...
execution_suspicious_python_app_execution_via_streamlit.toml in hunting/macos/queries	40	-	2025-04-23	2025-04-23	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...

Most Recently Changed Files (Top 50)

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
initial_access_entra_graph_single_session_from_multiple_addresses.toml in rules/integrations/azure	154	-	2025-05-10	2025-05-10	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
collection_graph_email_access_by_unusual_public_client_via_graph.toml in rules/integrations/azure	105	-	2025-05-10	2025-05-10	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
pyproject.toml in root	62	-	2022-01-26	2025-05-10	71	12	richard.boyd@elastic.co	99630311+terrancedejesus@us...
entra_suspicious_odata_client_requests.toml in hunting/azure/queries	59	-	2025-05-10	2025-05-10	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
defense_evasion_unusual_ads_file_creation.toml in rules/windows	161	-	2021-02-10	2025-05-09	40	12	56412096+bm11100@users.nore...	26856693+w0rk3r@users.norep...
persistence_exchange_suspicious_mailbox_permission_delegation.toml in rules/integrations/o365	121	-	2025-05-08	2025-05-08	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
collection_entra_auth_broker_sharepoint_access_for_user_principal.toml in rules/integrations/azure	111	-	2025-05-05	2025-05-07	2	2	99630311+terrancedejesus@us...	91139415+shashank-elastic@u...
devtools.py in detection_rules	1125	47	2020-10-07	2025-05-06	92	11	brokensound77@users.noreply...	119343520+eric-forte-elasti...
utils.py in detection_rules	339	44	2020-06-30	2025-05-06	38	6	31489089+rw-access@users.no...	119343520+eric-forte-elasti...
command_and_control_common_webservices.toml in rules/windows	315	-	2020-11-18	2025-05-06	47	10	64742097+samirbous@users.no...	64742097+samirbous@users.no...
threat_intel_indicator_match_hash.toml in rules/threat_intel	191	-	2024-06-12	2025-05-06	4	4	99630311+terrancedejesus@us...	26856693+w0rk3r@users.norep...
threat_intel_indicator_match_url.toml in rules/threat_intel	160	-	2024-06-12	2025-05-06	4	4	99630311+terrancedejesus@us...	26856693+w0rk3r@users.norep...
threat_intel_indicator_match_address.toml in rules/threat_intel	157	-	2024-06-12	2025-05-06	4	4	99630311+terrancedejesus@us...	26856693+w0rk3r@users.norep...
threat_intel_indicator_match_registry.toml in rules/threat_intel	146	-	2024-06-12	2025-05-06	4	4	99630311+terrancedejesus@us...	26856693+w0rk3r@users.norep...
threat_intel_indicator_match_email.toml in rules/threat_intel	140	-	2025-04-22	2025-05-06	2	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
defense_evasion_hex_payload_execution_via_utility.toml in rules/linux	133	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
defense_evasion_entra_suspicious_auth_broker_activity_on_behalf_of_principal_user.toml in rules/integrations/azure	128	-	2025-05-06	2025-05-06	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
defense_evasion_ld_preload_cmdline.toml in rules/linux	109	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
credential_access_entra_signin_brute_force_microsoft_365.toml in rules/integrations/azure	105	-	2024-09-10	2025-05-06	5	4	99630311+terrancedejesus@us...	65730960+jvalente-salemstat...
persistence_entra_service_principal_created.toml in rules/integrations/azure	103	-	2025-05-06	2025-05-06	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
discovery_proc_maps_read.toml in rules/linux	99	-	2024-02-06	2025-05-06	7	5	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
initial_access_azure_o365_with_network_alert.toml in rules/cross-platform	98	-	2025-05-06	2025-05-06	1	1	64742097+samirbous@users.no...	64742097+samirbous@users.no...
command_and_control_ml_dga_activity_using_sunburst_domain.toml in rules/integrations/dga	96	-	2023-10-16	2025-05-06	10	6	30438249+ajosh0504@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_hex_payload_execution_via_commandline.toml in rules/linux	92	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
execution_unusual_kthreadd_execution.toml in rules/linux	91	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
defense_evasion_posh_obfuscation_proportion_special_chars.toml in rules_building_block	90	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
defense_evasion_microsoft_365_susp_oauth2_authorization.toml in rules/integrations/o365	89	-	2025-05-06	2025-05-06	1	1	64742097+samirbous@users.no...	64742097+samirbous@users.no...
credential_access_azure_entra_suspicious_signin.toml in rules/integrations/azure	88	-	2025-05-06	2025-05-06	1	1	64742097+samirbous@users.no...	64742097+samirbous@users.no...
defense_evasion_posh_obfuscation_index_reversal.toml in rules/windows	88	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
defense_evasion_posh_obfuscation_high_number_proportion.toml in rules/windows	87	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
defense_evasion_posh_obfuscation_char_arrays.toml in rules/windows	87	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
defense_evasion_posh_obfuscation_whitespace_special_proportion.toml in rules/windows	87	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
execution_suspicious_mkfifo_execution.toml in rules/linux	87	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
command_and_control_cobalt_strike_default_teamserver_cert.toml in rules/network	86	-	2020-12-09	2025-05-06	21	8	7442091+peasead@users.norep...	26856693+w0rk3r@users.norep...
threat_intel_rapid7_threat_command.toml in rules/threat_intel	86	-	2024-06-12	2025-05-06	7	5	99630311+terrancedejesus@us...	26856693+w0rk3r@users.norep...
defense_evasion_posh_obfuscation_backtick.toml in rules/windows	85	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
defense_evasion_posh_obfuscation_iex_env_vars_reconstruction.toml in rules/windows	85	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
defense_evasion_posh_obfuscation_backtick_var.toml in rules/windows	85	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
defense_evasion_posh_obfuscation_reverse_keyword.toml in rules/windows	85	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
defense_evasion_posh_obfuscation_string_concat.toml in rules/windows	84	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
defense_evasion_posh_obfuscation_concat_dynamic.toml in rules/windows	82	-	2025-05-06	2025-05-06	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
credential_access_manual_memory_dumping.toml in rules/linux	81	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
defense_evasion_sysctl_kernel_feature_activity.toml in rules/linux	81	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
exfiltration_potential_curl_data_exfiltration.toml in rules/linux	80	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
command_and_control_telegram_api_request.toml in rules/linux	79	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
command_and_control_git_repo_or_file_download_to_sus_dir.toml in rules/linux	79	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
discovery_manual_mount_discovery_via_exports_or_fstab.toml in rules/linux	72	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
defense_evasion_symlink_binary_to_writable_dir.toml in rules/linux	70	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
persistence_pluggable_authentication_module_pam_exec_backdoor_exec.toml in rules/linux	70	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
credential_access_rare_webdav_destination.toml in rules/windows	68	-	2025-05-06	2025-05-06	1	1	64742097+samirbous@users.no...	64742097+samirbous@users.no...