A temporal dependency occurs when developers change two or more files at the same time (i.e. they are a part of the same commit).
| Pairs | # same commits | # commits 1 | # commits 2 | latest commit |
|---|---|---|---|---|
| detection_rules/kbwrap.py pyproject.toml |
4 | 32 (12%) | 103 (3%) | 2025-04-16 |
| detection_rules/packaging.py pyproject.toml |
3 | 64 (4%) | 103 (2%) | 2025-04-28 |
| detection_rules/rule.py detection_rules/packaging.py |
3 | 142 (2%) | 64 (4%) | 2025-04-28 |
| detection_rules/cli_utils.py pyproject.toml |
3 | 23 (13%) | 103 (2%) | 2025-04-17 |
| detection_rules/rule.py pyproject.toml |
3 | 142 (2%) | 103 (2%) | 2025-04-28 |
| detection_rules/kbwrap.py detection_rules/cli_utils.py |
2 | 32 (6%) | 23 (8%) | 2025-04-16 |
| detection_rules/utils.py pyproject.toml |
2 | 42 (4%) | 103 (1%) | 2025-05-06 |
| detection_rules/devtools.py pyproject.toml |
2 | 101 (1%) | 103 (1%) | 2025-05-06 |
| detection_rules/rule_loader.py pyproject.toml |
2 | 41 (4%) | 103 (1%) | 2025-04-30 |
| detection_rules/etc/stack-schema-map.yaml pyproject.toml |
2 | 40 (5%) | 103 (1%) | 2025-05-05 |
| rules/macos/defense_evasion_modify_environment_launchctl.toml rules/macos/credential_access_dumping_keychain_security.toml |
1 | 22 (4%) | 25 (4%) | 2025-04-21 |
| rules/macos/defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.toml rules/macos/credential_access_dumping_hashes_bi_cmds.toml |
1 | 25 (4%) | 19 (5%) | 2025-04-21 |
| rules/macos/defense_evasion_safari_config_change.toml rules/macos/credential_access_mitm_localhost_webproxy.toml |
1 | 19 (5%) | 21 (4%) | 2025-04-21 |
| rules/macos/privilege_escalation_root_crontab_filemod.toml rules/macos/defense_evasion_attempt_to_disable_gatekeeper.toml |
1 | 20 (5%) | 20 (5%) | 2025-04-21 |
| rules/macos/persistence_via_atom_init_file_modification.toml rules/macos/execution_script_via_automator_workflows.toml |
1 | 20 (5%) | 20 (5%) | 2025-04-21 |
| rules/macos/privilege_escalation_root_crontab_filemod.toml rules/macos/defense_evasion_install_root_certificate.toml |
1 | 20 (5%) | 21 (4%) | 2025-04-21 |
| rules/windows/defense_evasion_masquerading_as_elastic_endpoint_process.toml rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml |
1 | 48 (2%) | 24 (4%) | 2025-05-05 |
| rules/macos/persistence_screensaver_plist_file_modification.toml rules/macos/persistence_crontab_creation.toml |
1 | 21 (4%) | 16 (6%) | 2025-04-21 |
| rules/windows/defense_evasion_suspicious_short_program_name.toml rules/linux/defense_evasion_rename_esxi_index_file.toml |
1 | 21 (4%) | 15 (6%) | 2025-05-05 |
| hunting/macos/queries/credential_access_potential_python_stealer.toml pyproject.toml |
1 | 1 (100%) | 103 (<1%) | 2025-04-23 |
| rules/network/command_and_control_vnc_virtual_network_computing_from_the_internet.toml pyproject.toml |
1 | 37 (2%) | 103 (<1%) | 2025-05-05 |
| rules/macos/privilege_escalation_root_crontab_filemod.toml rules/macos/persistence_defense_evasion_hidden_launch_agent_deamon_logonitem_process.toml |
1 | 20 (5%) | 19 (5%) | 2025-04-21 |
| rules/macos/persistence_evasion_hidden_launch_agent_deamon_creation.toml rules/macos/persistence_account_creation_hide_at_logon.toml |
1 | 24 (4%) | 19 (5%) | 2025-04-21 |
| rules/macos/privilege_escalation_root_crontab_filemod.toml rules/macos/persistence_emond_rules_file_creation.toml |
1 | 20 (5%) | 25 (4%) | 2025-04-21 |
| rules/integrations/azure/initial_access_graph_first_occurrence_of_client_request.toml pyproject.toml |
1 | 1 (100%) | 103 (<1%) | 2025-05-02 |
| rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml rules/macos/credential_access_promt_for_pwd_via_osascript.toml |
1 | 26 (3%) | 31 (3%) | 2025-04-21 |
| rules/macos/lateral_movement_remote_ssh_login_enabled.toml rules/macos/defense_evasion_attempt_del_quarantine_attrib.toml |
1 | 34 (2%) | 35 (2%) | 2025-04-21 |
| rules/windows/defense_evasion_masquerading_trusted_directory.toml pyproject.toml |
1 | 41 (2%) | 103 (<1%) | 2025-05-05 |
| rules/macos/lateral_movement_vpn_connection_attempt.toml rules/macos/execution_defense_evasion_electron_app_childproc_node_js.toml |
1 | 25 (4%) | 19 (5%) | 2025-04-21 |
| hunting/macos/queries/execution_python_script_drop_and_execute.toml hunting/macos/queries/defense_evasion_self_deleting_python_script.toml |
1 | 1 (100%) | 1 (100%) | 2025-04-23 |
| rules/macos/privilege_escalation_explicit_creds_via_scripting.toml rules/macos/persistence_credential_access_authorization_plugin_creation.toml |
1 | 20 (5%) | 22 (4%) | 2025-04-21 |
| rules/macos/persistence_finder_sync_plugin_pluginkit.toml rules/macos/defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.toml |
1 | 20 (5%) | 25 (4%) | 2025-04-21 |
| rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml detection_rules/etc/stack-schema-map.yaml |
1 | 16 (6%) | 40 (2%) | 2025-05-05 |
| rules/windows/command_and_control_screenconnect_childproc.toml rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml |
1 | 15 (6%) | 24 (4%) | 2025-05-05 |
| hunting/macos/queries/execution_unsigned_or_untrusted_binary_fork_via_python.toml hunting/macos/queries/execution_suspicious_file_access_via_docker.toml |
1 | 1 (100%) | 1 (100%) | 2025-04-23 |
| detection_rules/integrations.py pyproject.toml |
1 | 29 (3%) | 103 (<1%) | 2025-05-05 |
| rules/macos/persistence_creation_change_launch_agents_file.toml rules/macos/defense_evasion_safari_config_change.toml |
1 | 20 (5%) | 19 (5%) | 2025-04-21 |
| detection_rules/main.py pyproject.toml |
1 | 57 (1%) | 103 (<1%) | 2025-04-16 |
| rules/macos/privilege_escalation_root_crontab_filemod.toml rules/macos/persistence_account_creation_hide_at_logon.toml |
1 | 20 (5%) | 19 (5%) | 2025-04-21 |
| rules/macos/defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.toml rules/macos/credential_access_credentials_keychains.toml |
1 | 25 (4%) | 28 (3%) | 2025-04-21 |
| rules/macos/persistence_docker_shortcuts_plist_modification.toml rules/macos/persistence_creation_hidden_login_item_osascript.toml |
1 | 22 (4%) | 25 (4%) | 2025-04-21 |
| rules/macos/persistence_modification_sublime_app_plugin_or_script.toml rules/macos/defense_evasion_tcc_bypass_mounted_apfs_access.toml |
1 | 27 (3%) | 21 (4%) | 2025-04-21 |
| rules_building_block/defense_evasion_masquerading_browsers.toml rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml |
1 | 13 (7%) | 24 (4%) | 2025-05-05 |
| rules/macos/persistence_defense_evasion_hidden_launch_agent_deamon_logonitem_process.toml rules/macos/execution_initial_access_suspicious_browser_childproc.toml |
1 | 19 (5%) | 22 (4%) | 2025-04-21 |
| rules/macos/persistence_via_atom_init_file_modification.toml rules/macos/persistence_directory_services_plugins_modification.toml |
1 | 20 (5%) | 21 (4%) | 2025-04-21 |
| rules/macos/privilege_escalation_exploit_adobe_acrobat_updater.toml rules/macos/persistence_docker_shortcuts_plist_modification.toml |
1 | 20 (5%) | 22 (4%) | 2025-04-21 |
| rules/threat_intel/threat_intel_indicator_match_url.toml rules/threat_intel/threat_intel_indicator_match_email.toml |
1 | 4 (25%) | 2 (50%) | 2025-05-06 |
| rules/macos/persistence_docker_shortcuts_plist_modification.toml rules/macos/defense_evasion_sandboxed_office_app_suspicious_zip_file.toml |
1 | 22 (4%) | 22 (4%) | 2025-04-21 |
| rules/macos/persistence_emond_rules_process_execution.toml rules/macos/lateral_movement_remote_ssh_login_enabled.toml |
1 | 22 (4%) | 34 (2%) | 2025-04-21 |
| rules/macos/credential_access_promt_for_pwd_via_osascript.toml rules/macos/credential_access_mitm_localhost_webproxy.toml |
1 | 31 (3%) | 21 (4%) | 2025-04-21 |
