elastic / protections-artifacts - File Age & Freshness

File age measurements show the distribution of file ages (days since the first commit) and the file freshness (days since the latest commit).

Summary

Number of files: 1,674
Daily file updates (only one update per file and date counted): 2611
First update: 2022-07-29
Latest update: 2025-05-08
Days between first and latest update: 1,015 (145 weeks, estimated 725 working days)
Active days (at least one file change): 136
Data:

Organized per file

File Change History Overall

File Age Distribution Overall

Days since first update

There are 1,674 files with 113,130 lines of code in files.

547 files that are 366+ days old (39,183 lines of code)
949 files that are 181-365 days old (61,156 lines of code)
105 files that are 91-180 days old (8,353 lines of code)
49 files that are 31-90 days old (3,168 lines of code)
24 files that are 1-30 days old (1,270 lines of code)

Legend:

366+

181-365

91-180

31-90

1-30

explore: grouped by folders | grouped by age

File Freshness Distribution Overall

Days since last update

There are 1,674 files with 113,130 lines of code in files.

509 files have been last changed 366+ days ago (27,132 lines of code)
470 files have been last changed 181-365 days ago (34,656 lines of code)
178 files have been last changed 91-180 days ago (10,559 lines of code)
334 files have been last changed 31-90 days ago (26,126 lines of code)
183 files have been last changed 1-30 days ago (14,657 lines of code)

Legend:

366+

181-365

91-180

31-90

1-30

explore: grouped by folders | grouped by freshness

File Change History per File Extension

toml, yar, md, txt, gitignore, py, gitattributes, ps1, lua, yaml

File Age Distribution per Extension

Days since first update

366+

181-365

91-180

31-90

1-30

File Freshness Distribution per Extension

Days since last update

366+

181-365

91-180

31-90

1-30

File Change History per Logical Decomposition

primary

primary (file age distribution)

Days since first update

366+

181-365

91-180

31-90

1-30

primary (file freshness distribution)

Days since last update

366+

181-365

91-180

31-90

1-30

Oldest Files (Top 50)

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
yar Linux_Trojan_Mirai.yar in yara/rules	1862	-	2022-07-29	2024-06-12	6	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Gafgyt.yar in yara/rules	1392	-	2022-07-29	2024-06-12	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_CobaltStrike.yar in yara/rules	1041	-	2022-07-29	2023-08-08	5	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Trickbot.yar in yara/rules	937	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Cryptominer_Generic.yar in yara/rules	855	-	2022-07-29	2024-11-04	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Hacktool_Flooder.yar in yara/rules	607	-	2022-07-29	2023-10-23	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Tsunami.yar in yara/rules	512	-	2022-07-29	2024-06-12	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Xorddos.yar in yara/rules	453	-	2022-07-29	2024-11-04	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_IcedID.yar in yara/rules	357	-	2022-07-29	2024-02-09	9	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Metasploit.yar in yara/rules	355	-	2022-07-29	2024-01-12	5	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Generic.yar in yara/rules	328	-	2022-07-29	2024-11-04	5	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Generic.yar in yara/rules	316	-	2022-07-29	2024-03-21	8	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Exploit_CVE_2016_5195.yar in yara/rules	304	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Exploit_Lotoor.yar in yara/rules	304	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Cryptominer_Malxmr.yar in yara/rules	303	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Cryptominer_Camelot.yar in yara/rules	282	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar MacOS_Trojan_Metasploit.yar in yara/rules	261	-	2022-07-29	2022-11-18	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Mobidash.yar in yara/rules	243	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Exploit_Local.yar in yara/rules	228	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Cryptominer_Xmrminer.yar in yara/rules	226	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Cryptominer_Xmrig.yar in yara/rules	225	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar MacOS_Trojan_Bundlore.yar in yara/rules	209	-	2022-07-29	2022-11-18	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_RedLineStealer.yar in yara/rules	200	-	2022-07-29	2024-05-08	8	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_BruteRatel.yar in yara/rules	198	-	2022-07-29	2024-05-08	7	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Ngioweb.yar in yara/rules	170	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Hacktool_Mimikatz.yar in yara/rules	170	-	2022-07-29	2023-06-13	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_BPFDoor.yar in yara/rules	169	-	2022-07-29	2024-02-13	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Emotet.yar in yara/rules	160	-	2022-07-29	2024-02-09	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Ransomware_Ryuk.yar in yara/rules	152	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Shellcode_Generic.yar in yara/rules	152	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_AgentTesla.yar in yara/rules	144	-	2022-07-29	2024-02-09	5	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Smokeloader.yar in yara/rules	139	-	2022-07-29	2024-10-01	5	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Rootkit_R77.yar in yara/rules	136	-	2022-07-29	2024-02-09	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Dropperl.yar in yara/rules	133	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Sshdoor.yar in yara/rules	133	-	2022-07-29	2024-11-04	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Rekoobe.yar in yara/rules	133	-	2022-07-29	2022-11-16	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Qbot.yar in yara/rules	132	-	2022-07-29	2024-02-22	5	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar MacOS_Trojan_Thiefquest.yar in yara/rules	117	-	2022-07-29	2022-11-18	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Exploit_Enoket.yar in yara/rules	114	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Vidar.yar in yara/rules	110	-	2022-07-29	2024-10-24	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Blister.yar in yara/rules	106	-	2022-07-29	2024-10-24	6	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Exploit_Vmsplice.yar in yara/rules	95	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Iroffer.yar in yara/rules	95	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Ddostf.yar in yara/rules	94	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Cryptominer_Stak.yar in yara/rules	94	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Ransomware_Ragnarok.yar in yara/rules	92	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Ransomware_Maze.yar in yara/rules	91	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Ransomware_Clop.yar in yara/rules	89	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Ransomware_Sodinokibi.yar in yara/rules	89	-	2022-07-29	2024-02-09	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Netwire.yar in yara/rules	87	-	2022-07-29	2024-02-09	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...

Files Not Recently Changed (Top 50)

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
yar Linux_Trojan_Zpevdo.yar in yara/rules	18	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Ebury.yar in yara/rules	18	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Marut.yar in yara/rules	18	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Godlua.yar in yara/rules	18	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Multi_AttackSimulation_Blindspot.yar in yara/rules	18	-	2022-08-16	2022-09-19	2	1	72879786+protectionsmachine...	72879786+protectionsmachine...
yar Linux_Hacktool_Infectionmonkey.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Rooter.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Cryptominer_Presenoker.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Banload.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Exploit_CVE_2014_3153.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Cryptominer_Casdet.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Exploit_Dcom.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Backdoor_Bash.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Lady.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Virus_Staffcounter.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Farfli.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Sambashell.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Cryptominer_Zexaf.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Cryptominer_Xpaj.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_VulnDriver_ProcId.yar in yara/rules	19	-	2022-09-19	2022-09-19	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
yar Linux_Exploit_CVE_2019_13272.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Hacktool_Tcpscan.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Exploit_Alie.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_ProtectS.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Pnscan.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Bish.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Ransomware_Gonnacry.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Exploit_Openssl.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Ransomware_Rook.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_CaesarKbd.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Rotajakiro.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Ransomware_Sodinokibi.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_VulnDriver_EneIo.yar in yara/rules	19	-	2022-09-19	2022-09-19	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
yar Linux_Trojan_Bedevil.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Rozena.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Xpmmap.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Chinaz.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Exploit_Dirtycow.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Hacktool_Gmer.yar in yara/rules	19	-	2022-09-19	2022-09-19	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
yar Linux_Trojan_Asacub.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Backegmm.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Hiddad.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Cryptominer_Miancha.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Merlin.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Octopus.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Cerbu.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Exploit_CVE_2016_4557.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Cryptominer_Attribute.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Torii.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Exploit_Race.yar in yara/rules	19	-	2022-07-29	2022-09-19	2	2	mika.ayenson@elastic.co	72879786+protectionsmachine...

Most Recently Created Files (Top 50)

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
defense_evasion_ntdll_memory_protection_change_via_unsigned_dll.toml in behavior/rules/windows	80	-	2025-05-08	2025-05-08	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_suspicious_php_script_execution.toml in behavior/rules/windows	69	-	2025-05-08	2025-05-08	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_asynchronous_procedure_call_from_unusual_module.toml in behavior/rules/windows	62	-	2025-05-08	2025-05-08	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_potential_powershell_empire_execution.toml in behavior/rules/windows	43	-	2025-05-08	2025-05-08	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_powershell_empire_script_execution.toml in behavior/rules/windows	41	-	2025-05-08	2025-05-08	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_evasion_via_sleep_api_hooking.toml in behavior/rules/windows	38	-	2025-05-08	2025-05-08	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_potential_netntlmv1_downgrade_attack.toml in behavior/rules/windows	34	-	2025-05-08	2025-05-08	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_windows_api_call_via_indirect_random_syscall.toml in behavior/rules/windows	108	-	2025-04-29	2025-04-29	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_suspicious_windows_core_module_change.toml in behavior/rules/windows	90	-	2025-04-29	2025-05-08	2	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_direct_syscall_from_unsigned_module.toml in behavior/rules/windows	80	-	2025-04-29	2025-04-29	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
credential_access_remote_access_to_sensitive_registry_keys.toml in behavior/rules/windows	56	-	2025-04-29	2025-04-29	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_launchpad_hijack.toml in behavior/rules/macos	56	-	2025-04-29	2025-04-29	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_payload_delivery_via_curl_and_immediate_execution.toml in behavior/rules/macos	55	-	2025-04-29	2025-04-29	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_image_load_via_synthetic_stack_spoofing.toml in behavior/rules/windows	53	-	2025-04-29	2025-04-29	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_com_to_.net_redirection_via_registry.toml in behavior/rules/windows	50	-	2025-04-29	2025-04-29	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
collection_suspicious_image_creation_via_screencapture.toml in behavior/rules/macos	49	-	2025-04-29	2025-04-29	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_suspicious_deobfuscation_via_shell_script.toml in behavior/rules/macos	43	-	2025-04-29	2025-04-29	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
command_and_control_suspicious_binary_aws_s3_connection.toml in behavior/rules/macos	41	-	2025-04-29	2025-04-29	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_temporary_binary_execution_via_osascript.toml in behavior/rules/macos	41	-	2025-04-29	2025-04-29	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
command_and_control_network_connection_to_oast_domain_via_package_service_or_script.toml in behavior/rules/macos	39	-	2025-04-29	2025-04-29	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_suspicious_finder_cache_file_modification.toml in behavior/rules/macos	38	-	2025-04-29	2025-04-29	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
command_and_control_suspicious_executable_download_via_curl.toml in behavior/rules/macos	37	-	2025-04-29	2025-04-29	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
command_and_control_curl_local_file_read_or_write_via_osascript.toml in behavior/rules/macos	35	-	2025-04-29	2025-04-29	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_killall_execution_via_python.toml in behavior/rules/macos	32	-	2025-04-29	2025-04-29	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
yar Windows_Trojan_ShelbyLoader.yar in yara/rules	25	-	2025-04-03	2025-04-03	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
yar Windows_Trojan_ShelbyC2.yar in yara/rules	23	-	2025-04-03	2025-04-03	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_suspicious_command_shell_execution_via_windows_run.toml in behavior/rules/windows	71	-	2025-03-24	2025-04-29	2	1	72879786+protectionsmachine...	72879786+protectionsmachine...
credential_access_crypto_wallet_or_web_browser_file_access_via_osascript.toml in behavior/rules/macos	65	-	2025-03-24	2025-03-24	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
credential_access_crypto_wallet_or_web_browser_file_access_via_python.toml in behavior/rules/macos	65	-	2025-03-24	2025-03-24	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_api_call_via_jump_rop_gadget.toml in behavior/rules/windows	64	-	2025-03-24	2025-04-29	2	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_unsigned_or_untrusted_binary_execution_via_zshrc.toml in behavior/rules/macos	53	-	2025-03-24	2025-03-24	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
privilege_escalation_potential_exploitation_via_comdotnet_exploit.toml in behavior/rules/windows	49	-	2025-03-24	2025-03-24	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_potential_elastic_tampering_via_pendingfilerename.toml in behavior/rules/windows	47	-	2025-03-24	2025-03-24	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_suspicious_large_script_execution_via_shell_command.toml in behavior/rules/macos	47	-	2025-03-24	2025-03-24	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_library_loaded_via_thread_fiber_callback.toml in behavior/rules/windows	45	-	2025-03-24	2025-03-24	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_unusual_bundle_execution_via_shell.toml in behavior/rules/macos	44	-	2025-03-24	2025-03-24	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_arbitrary_python_code_execution_via_nodejs.toml in behavior/rules/macos	39	-	2025-03-24	2025-03-24	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_api_call_via_timer_callback_event.toml in behavior/rules/windows	36	-	2025-03-24	2025-03-24	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_lone_binary_execution_from_volume_mount.toml in behavior/rules/macos	36	-	2025-03-24	2025-03-24	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
yar Linux_Hacktool_Outlaw.yar in yara/rules	84	-	2025-03-07	2025-03-07	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
yar Multi_Cryptominer_Xmrig.yar in yara/rules	25	-	2025-03-07	2025-03-07	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_shellcode_api_behavior_from_a_signed_module.toml in behavior/rules/windows	248	-	2025-03-04	2025-03-24	2	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_memory_allocation_from_a_high_entropy_module.toml in behavior/rules/windows	74	-	2025-03-04	2025-03-04	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_shellcode_behavior_from_suspicious_rwx_provenance.toml in behavior/rules/windows	74	-	2025-03-04	2025-03-04	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
credential_access_crypto_wallet_or_web_browser_file_access_via_nodejs.toml in behavior/rules/macos	66	-	2025-03-04	2025-03-04	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
privilege_escalation_msi_rollback_script_file_by_unusual_process.toml in behavior/rules/windows	60	-	2025-03-04	2025-03-04	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
command_and_control_suspicious_network_connection_to_gmail_via_nodejs.toml in behavior/rules/macos	58	-	2025-03-04	2025-03-04	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
command_and_control_curl_to_suspicious_top_level_domain.toml in behavior/rules/macos	51	-	2025-03-04	2025-03-24	2	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_unusual_launch_service_creation_via_unsigned_or_untrusted_binary.toml in behavior/rules/macos	50	-	2025-03-04	2025-03-04	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
credential_access_suspicious_user_keychain_access_via_nodejs.toml in behavior/rules/macos	48	-	2025-03-04	2025-03-04	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...

Most Recently Changed Files (Top 50)

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
persistence_unusual_command_executed_by_web_server.toml in behavior/rules/linux	119	-	2025-01-21	2025-05-08	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_suspicious_windows_core_module_change.toml in behavior/rules/windows	90	-	2025-04-29	2025-05-08	2	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_ntdll_memory_protection_change_via_unsigned_dll.toml in behavior/rules/windows	80	-	2025-05-08	2025-05-08	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_amsi_or_wldp_bypass_via_memory_patching.toml in behavior/rules/windows	77	-	2024-07-10	2025-05-08	9	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_suspicious_remote_registry_modification.toml in behavior/rules/windows	75	-	2024-07-10	2025-05-08	5	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_suspicious_php_script_execution.toml in behavior/rules/windows	69	-	2025-05-08	2025-05-08	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_asynchronous_procedure_call_from_unusual_module.toml in behavior/rules/windows	62	-	2025-05-08	2025-05-08	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
command_and_control_potential_remote_desktop_protocol_tunneling.toml in behavior/rules/windows	52	-	2024-12-11	2025-05-08	4	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_initial_access_discovery_via_applet_executable.toml in behavior/rules/macos	48	-	2024-07-10	2025-05-08	5	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_amsi_bypass_via_unbacked_memory.toml in behavior/rules/windows	47	-	2024-11-28	2025-05-08	2	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_potential_powershell_empire_execution.toml in behavior/rules/windows	43	-	2025-05-08	2025-05-08	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_powershell_empire_script_execution.toml in behavior/rules/windows	41	-	2025-05-08	2025-05-08	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_evasion_via_sleep_api_hooking.toml in behavior/rules/windows	38	-	2025-05-08	2025-05-08	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_potential_netntlmv1_downgrade_attack.toml in behavior/rules/windows	34	-	2025-05-08	2025-05-08	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
lateral_movement_suspicious_process_execution_via_network_logon.toml in behavior/rules/windows	356	-	2024-07-10	2025-05-02	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
command_and_control_potential_known_tcp_port_traffic_tunneling.toml in behavior/rules/windows	78	-	2024-12-11	2025-05-02	4	1	72879786+protectionsmachine...	72879786+protectionsmachine...
privilege_escalation_newcredential_logon_by_a_suspicious_process.toml in behavior/rules/windows	73	-	2024-12-11	2025-05-02	6	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_network_module_loaded_from_suspicious_unbacked_memory.toml in behavior/rules/windows	249	-	2024-07-10	2025-04-29	16	1	72879786+protectionsmachine...	72879786+protectionsmachine...
command_and_control_connection_to_webservice_by_a_signed_binary_proxy.toml in behavior/rules/windows	231	-	2024-07-10	2025-04-29	12	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_binary_masquerading_via_untrusted_path.toml in behavior/rules/windows	214	-	2024-07-10	2025-04-29	5	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_remote_memory_write_to_trusted_target_process.toml in behavior/rules/windows	195	-	2025-02-04	2025-04-29	3	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_execution_from_unusual_directory.toml in behavior/rules/windows	189	-	2024-07-10	2025-04-29	5	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_process_memory_write_to_a_non_child_process.toml in behavior/rules/windows	184	-	2025-02-04	2025-04-29	3	1	72879786+protectionsmachine...	72879786+protectionsmachine...
lateral_movement_execution_of_a_file_dropped_from_smb_via_services.toml in behavior/rules/windows	181	-	2025-01-21	2025-04-29	2	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_remote_process_memory_write_by_low_reputation_module.toml in behavior/rules/windows	177	-	2025-02-20	2025-04-29	3	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_suspicious_echo_execution.toml in behavior/rules/linux	165	-	2024-10-03	2025-04-29	10	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_parent_process_pid_spoofing.toml in behavior/rules/windows	148	-	2024-07-10	2025-04-29	6	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_unbacked_shellcode_from_unsigned_module.toml in behavior/rules/windows	138	-	2024-12-11	2025-04-29	6	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_registry_or_file_modification_from_suspicious_memory.toml in behavior/rules/windows	135	-	2024-07-10	2025-04-29	3	1	72879786+protectionsmachine...	72879786+protectionsmachine...
credential_access_access_to_browser_credentials_from_suspicious_memory.toml in behavior/rules/windows	134	-	2024-07-10	2025-04-29	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_potential_shellcode_injection_via_clr.toml in behavior/rules/windows	125	-	2025-01-21	2025-04-29	3	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_shellcode_execution_from_low_reputation_module.toml in behavior/rules/windows	123	-	2024-07-10	2025-04-29	11	1	72879786+protectionsmachine...	72879786+protectionsmachine...
command_and_control_execution_from_suspicious_stack_trailing_bytes.toml in behavior/rules/windows	122	-	2024-07-10	2025-04-29	5	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_potential_shellcode_fluctuation_v1.toml in behavior/rules/windows	121	-	2024-09-18	2025-04-29	2	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_hidden_payload_executed_via_scheduled_job.toml in behavior/rules/linux	121	-	2024-08-07	2025-04-29	12	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_suspicious_parent_child_relationship.toml in behavior/rules/windows	116	-	2024-07-10	2025-04-29	3	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_potential_suspended_process_code_injection.toml in behavior/rules/windows	116	-	2024-07-10	2025-04-29	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_scheduled_task_unusual_command_execution.toml in behavior/rules/linux	115	-	2024-07-10	2025-04-29	6	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_shared_object_injection_via_process_environment_variable.toml in behavior/rules/linux	114	-	2024-10-29	2025-04-29	6	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_systemd_execution_followed_by_network_connection.toml in behavior/rules/linux	113	-	2024-09-18	2025-04-29	10	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_suspicious_memory_page_protection.toml in behavior/rules/windows	112	-	2025-02-20	2025-04-29	4	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_virtualalloc_api_call_from_an_unsigned_dll.toml in behavior/rules/windows	110	-	2024-07-10	2025-04-29	6	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_potential_remote_code_injection.toml in behavior/rules/windows	109	-	2024-07-10	2025-04-29	3	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_windows_api_call_via_indirect_random_syscall.toml in behavior/rules/windows	108	-	2025-04-29	2025-04-29	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_decode_activity_via_web_server.toml in behavior/rules/linux	108	-	2025-01-21	2025-04-29	4	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_suspicious_remote_memory_allocation.toml in behavior/rules/windows	103	-	2024-07-10	2025-04-29	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_protected_process_light_bypass_via_dll_tampering.toml in behavior/rules/windows	101	-	2024-07-10	2025-04-29	9	1	72879786+protectionsmachine...	72879786+protectionsmachine...
credential_access_sensitive_file_access_ssh_saved_keys.toml in behavior/rules/windows	101	-	2024-07-10	2025-04-29	2	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_direct_syscall_via_assembly_bytes.toml in behavior/rules/windows	100	-	2024-07-10	2025-04-29	4	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_egress_network_connection_from_rpm_package.toml in behavior/rules/linux	99	-	2024-08-07	2025-04-29	5	1	72879786+protectionsmachine...	72879786+protectionsmachine...