elastic / protections-artifacts

Intro

For duplication, we look at places in code where there are 6 or more lines of code that are exactly the same.
Before duplication is calculated, the code is cleaned to remove empty lines, comments, and frequently duplicated constructs such as imports.
You should aim at having as little as possible (<5%) of duplicated code as high-level of duplication can lead to maintenance difficulties, poor factoring, and logical contradictions.

Learn more...

Duplication Overall

42% duplication:

112,747 cleaned lines of cleaned code (without empty lines, comments, and frequently duplicated constructs such as imports)
48,466 duplicated lines

754,415 duplicates

dependency graphs: 2D graph | 3D graph | 3D graph (with duplicates)...

Duplication per Extension

Duplication per Component (primary)

Longest Duplicates

The list of 50 longest duplicates.

See data for all 754,415 duplicates...

Size	#	Folders	Files	Lines	Code
100	x 2	behavior/rules/windows behavior/rules/windows	defense_evasion_process_memory_write_... defense_evasion_remote_memory_write_t...	56:155 (54%) 60:159 (51%)	view
75	x 2	behavior/rules/windows behavior/rules/windows	defense_evasion_remote_memory_write_t... defense_evasion_remote_process_memory...	59:133 (38%) 49:123 (42%)	view
74	x 2	behavior/rules/windows behavior/rules/windows	defense_evasion_process_memory_write_... defense_evasion_remote_process_memory...	56:129 (40%) 50:123 (41%)	view
66	x 2	behavior/rules/windows behavior/rules/windows	execution_execution_via_outlook_appli... initial_access_suspicious_execution_v...	39:120 (64%) 49:130 (58%)	view
60	x 2	behavior/rules/windows behavior/rules/windows	execution_embedded_executable_via_win... execution_shell_execution_via_windows...	21:95 (75%) 32:106 (66%)	view
56	x 2	behavior/rules/windows behavior/rules/windows	execution_execution_via_outlook_appli... initial_access_execution_of_commonly_...	52:120 (54%) 58:126 (50%)	view
56	x 2	behavior/rules/windows behavior/rules/windows	initial_access_execution_of_commonly_... initial_access_suspicious_execution_v...	58:126 (50%) 62:130 (50%)	view
54	x 2	behavior/rules/windows behavior/rules/windows	command_and_control_suspicious_comman... execution_suspicious_windows_componen...	52:118 (48%) 153:219 (31%)	view
53	x 2	behavior/rules/macos behavior/rules/macos	credential_access_crypto_wallet_or_we... credential_access_crypto_wallet_or_we...	15:74 (80%) 14:73 (81%)	view
53	x 2	behavior/rules/macos behavior/rules/macos	credential_access_crypto_wallet_or_we... credential_access_crypto_wallet_or_we...	15:74 (80%) 14:73 (81%)	view
53	x 2	behavior/rules/macos behavior/rules/macos	credential_access_crypto_wallet_or_we... credential_access_crypto_wallet_or_we...	14:73 (81%) 14:73 (81%)	view
52	x 2	behavior/rules/linux behavior/rules/macos	defense_evasion_global_dynamic_linker... defense_evasion_dylib_injection_via_p...	23:86 (71%) 50:113 (52%)	view
52	x 2	behavior/rules/linux behavior/rules/linux	defense_evasion_global_dynamic_linker... defense_evasion_shared_object_injecti...	23:86 (71%) 64:127 (45%)	view
52	x 2	behavior/rules/linux behavior/rules/macos	defense_evasion_shared_object_injecti... defense_evasion_dylib_injection_via_p...	64:127 (45%) 50:113 (52%)	view
50	x 2	behavior/rules/linux behavior/rules/linux	defense_evasion_base64_shebang_payloa... defense_evasion_suspicious_base64_str...	33:94 (61%) 57:118 (53%)	view
50	x 2	behavior/rules/linux behavior/rules/linux	defense_evasion_linux_payload_decoded... defense_evasion_suspicious_base64_str...	36:97 (59%) 57:118 (53%)	view
50	x 2	behavior/rules/windows behavior/rules/windows	privilege_escalation_uac_bypass_attem... privilege_escalation_uac_bypass_attem...	27:88 (66%) 28:89 (65%)	view
50	x 2	behavior/rules/linux behavior/rules/linux	defense_evasion_base64_or_xxd_decode_... defense_evasion_suspicious_base64_str...	18:79 (75%) 57:118 (53%)	view
50	x 2	behavior/rules/linux behavior/rules/linux	defense_evasion_base64_or_xxd_decode_... defense_evasion_linux_payload_decoded...	18:79 (75%) 36:97 (59%)	view
50	x 2	behavior/rules/linux behavior/rules/linux	defense_evasion_base64_shebang_payloa... defense_evasion_linux_payload_decoded...	33:94 (61%) 36:97 (59%)	view
50	x 2	behavior/rules/linux behavior/rules/linux	defense_evasion_base64_or_xxd_decode_... defense_evasion_base64_shebang_payloa...	18:79 (75%) 33:94 (61%)	view
50	x 2	behavior/rules/windows behavior/rules/windows	initial_access_registry_modification_... persistence_registry_persistence_via_...	45:106 (54%) 50:111 (51%)	view
49	x 2	behavior/rules/linux behavior/rules/linux	persistence_file_downloaded_to_suspic... persistence_potential_web_server_dire...	43:102 (54%) 35:94 (59%)	view
49	x 2	behavior/rules/linux behavior/rules/linux	persistence_potential_web_server_dire... persistence_suspicious_download_and_r...	35:94 (59%) 45:104 (53%)	view
49	x 2	behavior/rules/linux behavior/rules/linux	persistence_file_downloaded_to_suspic... persistence_suspicious_download_and_r...	43:102 (54%) 45:104 (53%)	view
48	x 2	behavior/rules/linux behavior/rules/linux	persistence_file_downloaded_from_susp... persistence_unusual_command_executed_...	36:94 (58%) 73:131 (40%)	view
48	x 2	behavior/rules/linux behavior/rules/linux	persistence_file_downloaded_and_piped... persistence_file_downloaded_from_susp...	34:92 (60%) 36:94 (58%)	view
48	x 2	behavior/rules/linux behavior/rules/linux	persistence_file_downloaded_and_piped... persistence_suspicious_download_and_r...	34:92 (60%) 46:104 (52%)	view
48	x 2	behavior/rules/linux behavior/rules/linux	persistence_egress_network_connection... persistence_egress_network_connection...	52:110 (50%) 55:113 (48%)	view
48	x 2	behavior/rules/linux behavior/rules/linux	persistence_file_downloaded_and_piped... persistence_potential_web_server_dire...	34:92 (60%) 36:94 (58%)	view
48	x 2	behavior/rules/linux behavior/rules/linux	persistence_file_downloaded_from_susp... persistence_file_downloaded_to_suspic...	36:94 (58%) 44:102 (53%)	view
48	x 2	behavior/rules/linux behavior/rules/linux	persistence_file_downloaded_from_susp... persistence_suspicious_download_and_r...	36:94 (58%) 46:104 (52%)	view
48	x 2	behavior/rules/linux behavior/rules/linux	persistence_potential_web_server_dire... persistence_unusual_command_executed_...	36:94 (58%) 73:131 (40%)	view
48	x 2	behavior/rules/windows behavior/rules/windows	persistence_script_interpreter_proces... persistence_startup_persistence_via_w...	45:104 (52%) 51:110 (49%)	view
48	x 2	behavior/rules/linux behavior/rules/linux	persistence_file_downloaded_from_susp... persistence_potential_web_server_dire...	36:94 (58%) 36:94 (58%)	view
48	x 2	behavior/rules/linux behavior/rules/linux	persistence_file_downloaded_to_suspic... persistence_unusual_command_executed_...	44:102 (53%) 73:131 (40%)	view
48	x 2	behavior/rules/linux behavior/rules/linux	persistence_file_downloaded_and_piped... persistence_unusual_command_executed_...	34:92 (60%) 73:131 (40%)	view
48	x 2	behavior/rules/linux behavior/rules/linux	persistence_file_downloaded_and_piped... persistence_file_downloaded_to_suspic...	34:92 (60%) 44:102 (53%)	view
48	x 2	behavior/rules/linux behavior/rules/linux	persistence_suspicious_download_and_r... persistence_unusual_command_executed_...	46:104 (52%) 73:131 (40%)	view
48	x 2	behavior/rules/linux behavior/rules/linux	persistence_hidden_payload_executed_v... persistence_scheduled_task_unusual_co...	78:135 (39%) 62:119 (41%)	view
47	x 2	behavior/rules/linux behavior/rules/linux	persistence_file_downloaded_and_piped... persistence_suspicious_file_creation_...	35:92 (58%) 49:106 (50%)	view
47	x 2	behavior/rules/linux behavior/rules/linux	persistence_file_downloaded_to_suspic... persistence_suspicious_file_creation_...	45:102 (52%) 49:106 (50%)	view
47	x 2	behavior/rules/linux behavior/rules/linux	persistence_potential_web_server_dire... persistence_suspicious_file_creation_...	37:94 (57%) 49:106 (50%)	view
47	x 2	behavior/rules/linux behavior/rules/linux	persistence_suspicious_download_and_r... persistence_suspicious_file_creation_...	47:104 (51%) 49:106 (50%)	view
47	x 2	behavior/rules/linux behavior/rules/linux	persistence_suspicious_file_creation_... persistence_unusual_command_executed_...	49:106 (50%) 74:131 (39%)	view
47	x 2	behavior/rules/linux behavior/rules/linux	persistence_file_downloaded_from_susp... persistence_suspicious_file_creation_...	37:94 (57%) 49:106 (50%)	view
46	x 2	behavior/rules/linux behavior/rules/linux	persistence_motd_execution_followed_b... persistence_udev_execution_followed_b...	46:101 (51%) 42:97 (53%)	view
46	x 2	behavior/rules/linux behavior/rules/macos	defense_evasion_base64_shebang_payloa... defense_evasion_suspicious_openssl_ex...	37:93 (56%) 30:86 (62%)	view
46	x 2	behavior/rules/linux behavior/rules/linux	persistence_hidden_payload_executed_v... persistence_scheduled_job_executing_b...	82:138 (38%) 49:105 (50%)	view
46	x 2	behavior/rules/linux behavior/rules/macos	defense_evasion_linux_payload_decoded... defense_evasion_suspicious_openssl_ex...	40:96 (54%) 30:86 (62%)	view