elastic / detection-rules - File Change Frequency

File change frequency (churn) shows the distribution of file updates (days with at least one commit).

Overview

File Change Frequency Overall

There are 1,718 files with 169,942 lines of code.

1 file changed more than 100 times (1,152 lines of code)
13 files changed 51-100 times (3,079 lines of code)
344 files changed 21-50 times (43,489 lines of code)
723 files changed 6-20 times (70,106 lines of code)
637 files changed 1-5 times (52,116 lines of code)

Legend:

101+

51-100

21-50

6-20

1-5

explore: grouped by folders | grouped by update frequency | data

Contributors Count Frequency Overall

There are 1,718 files with 169,942 lines of code.

0 files changed by more than 25 contributors (0 lines of code)
132 files changed by 11-25 contributors (17,984 lines of code)
649 files changed by 6-10 contributors (68,534 lines of code)
644 files changed by 2-5 contributors (64,434 lines of code)
293 files changed by 1 contributor (18,990 lines of code)

Legend:

26+

11-25

6-10

2-5

explore: grouped by folders | grouped by contributors count | data

File Change Frequency per File Extension

toml, json, md, py, yaml, txt, bash, sh, svg, gitignore, g

File Change Frequency per Extension

The number of recorded file updates

101+

51-100

21-50

6-20

1-5

File Change Frequency per Logical Decomposition

primary

primary (file change frequency)

The number of recorded file updates

101+

51-100

21-50

6-20

1-5

Most Frequently Changed Files (Top 50)

See data for all files...

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
rule.py in detection_rules	1152	114	2020-06-30	2025-04-28	122	12	31489089+rw-access@users.no...	traut@users.noreply.github.com
devtools.py in detection_rules	1125	47	2020-10-07	2025-05-06	92	11	brokensound77@users.noreply...	119343520+eric-forte-elasti...
pyproject.toml in root	62	-	2022-01-26	2025-05-10	71	12	richard.boyd@elastic.co	99630311+terrancedejesus@us...
definitions.py in detection_rules/schemas	225	3	2021-03-09	2025-04-22	59	15	brokensound77@users.noreply...	26856693+w0rk3r@users.norep...
privilege_escalation_unusual_parentchild_relationship.toml in rules/windows	156	-	2020-06-30	2025-03-26	56	14	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
packaging.py in detection_rules	367	18	2020-06-30	2025-04-28	55	11	31489089+rw-access@users.no...	traut@users.noreply.github.com
privilege_escalation_uac_bypass_event_viewer.toml in rules/windows	149	-	2020-06-30	2025-03-26	54	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
persistence_adobe_hijack_persistence.toml in rules/windows	130	-	2020-06-30	2025-03-26	53	12	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
persistence_system_shells_via_services.toml in rules/windows	133	-	2020-06-30	2025-03-26	52	14	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
execution_command_shell_started_by_svchost.toml in rules/windows	152	-	2020-06-30	2025-03-26	52	15	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
command_and_control_remote_file_copy_mpcmdrun.toml in rules/windows	156	-	2020-09-22	2025-03-26	52	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
command_and_control_remote_file_copy_desktopimgdownldr.toml in rules/windows	158	-	2020-09-22	2025-03-26	52	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
persistence_priv_escalation_via_accessibility_features.toml in rules/windows	163	-	2020-06-30	2025-03-26	52	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_clearing_windows_event_logs.toml in rules/windows	103	-	2020-06-30	2025-03-26	51	16	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
command_and_control_teamviewer_remote_file_copy.toml in rules/windows	119	-	2020-09-22	2025-05-05	50	12	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
defense_evasion_disable_windows_firewall_rules_with_netsh.toml in rules/windows	87	-	2020-06-30	2025-03-26	49	14	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_execution_msbuild_started_by_office_app.toml in rules/windows	125	-	2020-06-30	2025-03-26	49	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
__init__.py in detection_rules/schemas	216	39	2020-07-23	2025-03-26	49	9	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
main.py in detection_rules	535	18	2020-06-30	2025-04-16	49	11	31489089+rw-access@users.no...	119343520+eric-forte-elasti...
execution_via_compiled_html_file.toml in rules/windows	153	-	2020-06-30	2025-03-26	48	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
persistence_via_update_orchestrator_service_hijack.toml in rules/windows	155	-	2020-09-29	2025-03-26	48	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
persistence_user_account_creation.toml in rules/windows	86	-	2020-06-30	2025-03-26	47	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
discovery_whoami_command_activity.toml in rules/windows	111	-	2020-06-30	2025-03-26	47	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
command_and_control_common_webservices.toml in rules/windows	315	-	2020-11-18	2025-05-06	47	10	64742097+samirbous@users.no...	64742097+samirbous@users.no...
defense_evasion_execution_msbuild_started_by_system_process.toml in rules/windows	98	-	2020-06-30	2025-03-26	46	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
execution_suspicious_pdf_reader.toml in rules/windows	123	-	2020-06-30	2025-03-26	46	12	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
lateral_movement_direct_outbound_smb_connection.toml in rules/windows	128	-	2020-06-30	2025-02-05	46	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
persistence_via_application_shimming.toml in rules/windows	106	-	2020-06-30	2025-03-26	45	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_execution_msbuild_started_renamed.toml in rules/windows	127	-	2020-06-30	2025-05-05	45	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
privilege_escalation_printspooler_suspicious_spl_file.toml in rules/windows	132	-	2020-09-29	2025-02-03	45	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
defense_evasion_execution_msbuild_started_by_script.toml in rules/windows	106	-	2020-06-30	2025-03-26	44	14	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
collection_email_powershell_exchange_mailbox.toml in rules/windows	120	-	2020-12-15	2025-03-26	44	11	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
defense_evasion_system_critical_proc_abnormal_file_activity.toml in rules/windows	134	-	2020-09-22	2025-03-26	44	12	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
defense_evasion_suspicious_zoom_child_process.toml in rules/windows	135	-	2020-09-30	2025-03-26	44	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
credential_access_credential_dumping_msbuild.toml in rules/windows	141	-	2020-06-30	2025-03-26	44	12	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml in rules/windows	141	-	2020-06-30	2025-03-26	44	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
execution_from_unusual_path_cmdline.toml in rules/windows	237	-	2020-12-08	2025-05-05	44	11	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
execution_python_tty_shell.toml in rules/linux	100	-	2020-06-30	2025-03-20	43	14	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_execution_msbuild_started_unusal_process.toml in rules/windows	103	-	2020-06-30	2025-03-26	43	14	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_masquerading_as_elastic_endpoint_process.toml in rules/windows	110	-	2020-09-22	2025-05-05	43	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
defense_evasion_masquerading_suspicious_werfault_childproc.toml in rules/windows	119	-	2020-09-22	2025-03-26	43	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
defense_evasion_hidden_file_dir_tmp.toml in rules/linux	125	-	2020-06-30	2025-02-05	43	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
privilege_escalation_uac_bypass_diskcleanup_hijack.toml in rules/windows	128	-	2020-09-22	2025-03-26	43	12	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
execution_register_server_program_connecting_to_the_internet.toml in rules/windows	146	-	2020-06-30	2025-03-26	43	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
privilege_escalation_uac_bypass_mock_windir.toml in rules/windows	150	-	2020-12-08	2025-05-05	43	11	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
credential_access_domain_backup_dpapi_private_keys.toml in rules/windows	70	-	2020-09-29	2025-03-26	42	12	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
credential_access_mimikatz_memssp_default_logs.toml in rules/windows	88	-	2020-09-22	2025-03-26	42	12	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
defense_evasion_masquerading_renamed_autoit.toml in rules/windows	116	-	2020-09-22	2025-05-05	42	12	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
persistence_via_telemetrycontroller_scheduledtask_hijack.toml in rules/windows	119	-	2020-09-22	2025-03-26	42	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
defense_evasion_via_filter_manager.toml in rules/windows	129	-	2020-06-30	2025-03-26	42	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...

Files With Most Contributors (Top 50)

Based on the number of unique email addresses found in commits.

See data for all files...

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
defense_evasion_clearing_windows_event_logs.toml in rules/windows	103	-	2020-06-30	2025-03-26	51	16	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
definitions.py in detection_rules/schemas	225	3	2021-03-09	2025-04-22	59	15	brokensound77@users.noreply...	26856693+w0rk3r@users.norep...
execution_command_shell_started_by_svchost.toml in rules/windows	152	-	2020-06-30	2025-03-26	52	15	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
privilege_escalation_unusual_parentchild_relationship.toml in rules/windows	156	-	2020-06-30	2025-03-26	56	14	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
persistence_system_shells_via_services.toml in rules/windows	133	-	2020-06-30	2025-03-26	52	14	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_disable_windows_firewall_rules_with_netsh.toml in rules/windows	87	-	2020-06-30	2025-03-26	49	14	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_execution_msbuild_started_by_script.toml in rules/windows	106	-	2020-06-30	2025-03-26	44	14	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_execution_msbuild_started_unusal_process.toml in rules/windows	103	-	2020-06-30	2025-03-26	43	14	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
execution_python_tty_shell.toml in rules/linux	100	-	2020-06-30	2025-03-20	43	14	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
command_and_control_rdp_remote_desktop_protocol_from_the_internet.toml in rules/network	125	-	2020-06-30	2025-01-22	33	14	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
command_and_control_vnc_virtual_network_computing_from_the_internet.toml in rules/network	115	-	2020-06-30	2025-05-05	32	14	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
command_and_control_vnc_virtual_network_computing_to_the_internet.toml in rules/network	106	-	2020-06-30	2025-05-05	32	14	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
initial_access_rpc_remote_procedure_call_from_the_internet.toml in rules/network	97	-	2020-06-30	2025-01-22	31	14	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
initial_access_rpc_remote_procedure_call_to_the_internet.toml in rules/network	97	-	2020-06-30	2025-01-22	31	14	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
initial_access_smb_windows_file_sharing_activity_to_the_internet.toml in rules/network	108	-	2020-06-30	2025-01-22	31	14	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
privilege_escalation_uac_bypass_event_viewer.toml in rules/windows	149	-	2020-06-30	2025-03-26	54	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
persistence_priv_escalation_via_accessibility_features.toml in rules/windows	163	-	2020-06-30	2025-03-26	52	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
command_and_control_remote_file_copy_desktopimgdownldr.toml in rules/windows	158	-	2020-09-22	2025-03-26	52	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
command_and_control_remote_file_copy_mpcmdrun.toml in rules/windows	156	-	2020-09-22	2025-03-26	52	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
defense_evasion_execution_msbuild_started_by_office_app.toml in rules/windows	125	-	2020-06-30	2025-03-26	49	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
execution_via_compiled_html_file.toml in rules/windows	153	-	2020-06-30	2025-03-26	48	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
persistence_via_update_orchestrator_service_hijack.toml in rules/windows	155	-	2020-09-29	2025-03-26	48	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
persistence_user_account_creation.toml in rules/windows	86	-	2020-06-30	2025-03-26	47	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
discovery_whoami_command_activity.toml in rules/windows	111	-	2020-06-30	2025-03-26	47	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
lateral_movement_direct_outbound_smb_connection.toml in rules/windows	128	-	2020-06-30	2025-02-05	46	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
defense_evasion_execution_msbuild_started_by_system_process.toml in rules/windows	98	-	2020-06-30	2025-03-26	46	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
persistence_via_application_shimming.toml in rules/windows	106	-	2020-06-30	2025-03-26	45	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_execution_msbuild_started_renamed.toml in rules/windows	127	-	2020-06-30	2025-05-05	45	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
privilege_escalation_printspooler_suspicious_spl_file.toml in rules/windows	132	-	2020-09-29	2025-02-03	45	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
defense_evasion_suspicious_zoom_child_process.toml in rules/windows	135	-	2020-09-30	2025-03-26	44	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml in rules/windows	141	-	2020-06-30	2025-03-26	44	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
execution_register_server_program_connecting_to_the_internet.toml in rules/windows	146	-	2020-06-30	2025-03-26	43	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_masquerading_suspicious_werfault_childproc.toml in rules/windows	119	-	2020-09-22	2025-03-26	43	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
defense_evasion_masquerading_as_elastic_endpoint_process.toml in rules/windows	110	-	2020-09-22	2025-05-05	43	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
defense_evasion_hidden_file_dir_tmp.toml in rules/linux	125	-	2020-06-30	2025-02-05	43	13	31489089+rw-access@users.no...	26856693+w0rk3r@users.norep...
persistence_via_telemetrycontroller_scheduledtask_hijack.toml in rules/windows	119	-	2020-09-22	2025-03-26	42	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
defense_evasion_via_filter_manager.toml in rules/windows	129	-	2020-06-30	2025-03-26	42	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_iis_httplogging_disabled.toml in rules/windows	90	-	2020-09-29	2025-03-26	41	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
defense_evasion_delete_volume_usn_journal_with_fsutil.toml in rules/windows	86	-	2020-06-30	2025-03-26	41	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
defense_evasion_execution_suspicious_explorer_winword.toml in rules/windows	104	-	2020-09-22	2025-04-22	40	13	64742097+samirbous@users.no...	26856693+w0rk3r@users.norep...
execution_suspicious_psexesvc.toml in rules/windows	93	-	2020-10-20	2025-05-05	40	13	brokensound77@users.noreply...	91139415+shashank-elastic@u...
credential_access_iis_connectionstrings_dumping.toml in rules/windows	92	-	2020-09-29	2025-03-26	40	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
execution_command_shell_started_by_unusual_process.toml in rules/windows	110	-	2020-09-28	2025-03-26	39	13	64742097+samirbous@users.no...	91139415+shashank-elastic@u...
defense_evasion_attempt_to_disable_iptables_or_firewall.toml in rules/linux	111	-	2020-06-30	2025-03-20	38	13	31489089+rw-access@users.no...	91139415+shashank-elastic@u...
execution_suspicious_powershell_imgload.toml in rules/windows	103	-	2020-12-18	2024-09-25	34	13	brokensound77@users.noreply...	mikaayenson@users.noreply.g...
defense_evasion_suspicious_wmi_script.toml in rules/windows	90	-	2020-10-20	2025-03-26	33	13	brokensound77@users.noreply...	91139415+shashank-elastic@u...
command_and_control_port_26_activity.toml in rules/network	77	-	2020-06-30	2025-01-22	32	13	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
command_and_control_nat_traversal_port_activity.toml in rules/network	67	-	2020-06-30	2025-01-22	30	13	31489089+rw-access@users.no...	mikaayenson@users.noreply.g...
credential_access_kerberosdump_kcc.toml in rules/macos	102	-	2020-09-30	2025-04-21	28	13	64742097+samirbous@users.no...	48036388+defsecsentinel@use...
command_and_control_download_rar_powershell_from_internet.toml in rules/network	111	-	2020-09-30	2025-01-22	27	13	7442091+peasead@users.norep...	mikaayenson@users.noreply.g...

Files With Least Contributors (Top 50)

Based on the number of unique email addresses found in commits.

See data for all files...

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
exception.py in detection_rules	199	10	2024-08-06	2024-08-06	1	1	119343520+eric-forte-elasti...	119343520+eric-forte-elasti...
persistence_via_systemd_timers.toml in hunting/linux/queries	180	-	2024-07-05	2024-07-05	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
__main__.py in hunting	161	7	2024-10-03	2024-10-03	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
initial_access_entra_graph_single_session_from_multiple_addresses.toml in rules/integrations/azure	154	-	2025-05-10	2025-05-10	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
lateral_movement_sns_topic_message_publish_by_rare_user.toml in rules/integrations/aws	142	-	2025-01-15	2025-01-15	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
threat_intel_indicator_match_email.toml in rules/threat_intel	140	-	2025-04-22	2025-05-06	2	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
defense_evasion_hex_payload_execution_via_utility.toml in rules/linux	133	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
resource_development_sns_topic_created_by_rare_user.toml in rules/integrations/aws	130	-	2025-02-20	2025-02-20	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
defense_evasion_entra_suspicious_auth_broker_activity_on_behalf_of_principal_user.toml in rules/integrations/azure	128	-	2025-05-06	2025-05-06	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
initial_access_microsoft_365_illicit_consent_grant_via_registered_application.toml in rules/integrations/o365	127	-	2025-03-27	2025-03-27	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
impact_s3_unusual_object_encryption_with_sse_c.toml in rules/integrations/aws	126	-	2025-01-15	2025-01-15	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
generic_loader.py in detection_rules	125	18	2024-08-06	2024-08-06	1	1	119343520+eric-forte-elasti...	119343520+eric-forte-elasti...
action_connector.py in detection_rules	124	6	2024-08-06	2024-08-06	1	1	119343520+eric-forte-elasti...	119343520+eric-forte-elasti...
search.py in hunting	124	10	2024-10-03	2024-10-03	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
discovery_suspicious_network_tool_launched_inside_container.toml in rules/linux	123	-	2025-04-10	2025-04-10	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
initial_access_entra_illicit_consent_grant_via_registered_application.toml in rules/integrations/azure	122	-	2025-03-27	2025-03-27	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
persistence_exchange_suspicious_mailbox_permission_delegation.toml in rules/integrations/o365	121	-	2025-05-08	2025-05-08	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
credential_access_collection_sensitive_files_compression_inside_a_container.toml in rules/_deprecated	121	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_posh_malicious_script_agg.toml in rules/windows	119	-	2025-04-22	2025-04-22	1	1	26856693+w0rk3r@users.norep...	26856693+w0rk3r@users.norep...
initial_access_entra_rare_authentication_requirement_for_principal_user.toml in rules/integrations/azure	116	-	2025-03-11	2025-04-16	2	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
lateral_movement_ssh_process_launched_inside_container.toml in rules/linux	116	-	2025-04-10	2025-04-10	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
credential_access_collection_sensitive_files_compression_inside_container.toml in rules/linux	112	-	2025-04-10	2025-04-10	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
persistence_iam_instance_request_to_iam_service.toml in rules_building_block	112	-	2024-11-06	2024-11-09	2	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
evaluator.py in lib/kql/kql	112	18	2024-03-15	2024-03-15	1	1	mikaayenson@users.noreply.g...	mikaayenson@users.noreply.g...
initial_access_graph_first_occurrence_of_client_request.toml in rules/integrations/azure	110	-	2025-05-02	2025-05-02	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
impact_s3_static_site_js_file_uploaded.toml in rules/integrations/aws	110	-	2025-04-30	2025-04-30	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
defense_evasion_ld_preload_cmdline.toml in rules/linux	109	-	2025-05-06	2025-05-06	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
exfiltration_dynamodb_scan_by_unusual_user.toml in rules/integrations/aws	108	-	2025-03-21	2025-03-21	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
discovery_suspicious_network_tool_launched_inside_a_container.toml in rules/_deprecated	107	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
execution_file_made_executable_via_chmod_inside_container.toml in rules/linux	106	-	2025-04-10	2025-04-10	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
collection_graph_email_access_by_unusual_public_client_via_graph.toml in rules/integrations/azure	105	-	2025-05-10	2025-05-10	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
initial_access_entra_oauth_phishing_via_vscode_client.toml in rules/integrations/azure	104	-	2025-05-02	2025-05-02	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
impact_s3_excessive_object_encryption_with_sse_c.toml in rules/integrations/aws	104	-	2025-01-15	2025-01-15	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
exfiltration_dynamodb_table_exported_to_s3.toml in rules/integrations/aws	104	-	2025-03-21	2025-03-21	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
execution_interactive_exec_to_container.toml in rules/_deprecated	104	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
persistence_entra_service_principal_created.toml in rules/integrations/azure	103	-	2025-05-06	2025-05-06	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
initial_access_ssh_connection_established_inside_a_container.toml in rules/_deprecated	103	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
persistence_ssh_authorized_keys_modification_inside_a_container.toml in rules/_deprecated	102	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
markdown.py in hunting	102	10	2024-10-03	2024-10-03	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
initial_access_microsoft_365_entra_oauth_phishing_via_vscode_client.toml in rules/integrations/o365	101	-	2025-05-02	2025-05-02	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
lateral_movement_ssh_process_launched_inside_a_container.toml in rules/_deprecated	101	-	2025-03-14	2025-03-14	1	1	91139415+shashank-elastic@u...	91139415+shashank-elastic@u...
persistence_bpf_probe_write_user.toml in rules/linux	101	-	2025-01-29	2025-01-29	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
persistence_via_grub_bootloader.toml in hunting/linux/queries	101	-	2025-01-27	2025-01-27	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
privilege_escalation_iam_update_assume_role_policy.toml in rules/integrations/aws	100	-	2025-01-31	2025-01-31	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
command_and_control_linux_port_knocking_reverse_connection.toml in rules/_deprecated	100	-	2024-03-07	2024-03-07	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
credential_access_sensitive_keys_or_passwords_search_inside_container.toml in rules/linux	100	-	2025-04-10	2025-04-10	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
credential_access_aws_creds_search_inside_container.toml in rules/linux	99	-	2025-04-10	2025-04-10	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
execution_container_management_binary_launched_inside_container.toml in rules/linux	99	-	2025-04-10	2025-04-10	1	1	78494512+aegrah@users.norep...	78494512+aegrah@users.norep...
initial_access_entra_rare_app_id_for_principal_auth.toml in rules/integrations/azure	98	-	2025-03-11	2025-03-11	1	1	99630311+terrancedejesus@us...	99630311+terrancedejesus@us...
initial_access_azure_o365_with_network_alert.toml in rules/cross-platform	98	-	2025-05-06	2025-05-06	1	1	64742097+samirbous@users.no...	64742097+samirbous@users.no...