elastic / protections-artifacts - File Change Frequency

File change frequency (churn) shows the distribution of file updates (days with at least one commit).

Overview

File Change Frequency Overall

There are 1,674 files with 113,130 lines of code.

0 files changed more than 100 times (0 lines of code)
0 files changed 51-100 times (0 lines of code)
0 files changed 21-50 times (0 lines of code)
89 files changed 6-20 times (14,715 lines of code)
1,585 files changed 1-5 times (98,415 lines of code)

Legend:

101+

51-100

21-50

6-20

1-5

explore: grouped by folders | grouped by update frequency | data

Contributors Count Frequency Overall

There are 1,674 files with 113,130 lines of code.

0 files changed by more than 25 contributors (0 lines of code)
0 files changed by 11-25 contributors (0 lines of code)
0 files changed by 6-10 contributors (0 lines of code)
339 files changed by 2-5 contributors (24,559 lines of code)
1,335 files changed by 1 contributor (88,571 lines of code)

Legend:

26+

11-25

6-10

2-5

explore: grouped by folders | grouped by contributors count | data

File Change Frequency per File Extension

toml, yar, md, txt, gitignore, py, gitattributes, ps1, lua, yaml

File Change Frequency per Extension

The number of recorded file updates

101+

51-100

21-50

6-20

1-5

File Change Frequency per Logical Decomposition

primary

primary (file change frequency)

The number of recorded file updates

101+

51-100

21-50

6-20

1-5

Most Frequently Changed Files (Top 50)

See data for all files...

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
defense_evasion_network_module_loaded_from_suspicious_unbacked_memory.toml in behavior/rules/windows	249	-	2024-07-10	2025-04-29	16	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_network_connection_through_shell_profile.toml in behavior/rules/linux	89	-	2024-08-07	2025-04-29	12	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_hidden_payload_executed_via_scheduled_job.toml in behavior/rules/linux	121	-	2024-08-07	2025-04-29	12	1	72879786+protectionsmachine...	72879786+protectionsmachine...
command_and_control_connection_to_webservice_by_a_signed_binary_proxy.toml in behavior/rules/windows	231	-	2024-07-10	2025-04-29	12	1	72879786+protectionsmachine...	72879786+protectionsmachine...
privilege_escalation_privilege_escalation_via_seimpersonateprivilege.toml in behavior/rules/windows	94	-	2024-07-10	2025-04-29	11	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_shellcode_execution_from_low_reputation_module.toml in behavior/rules/windows	123	-	2024-07-10	2025-04-29	11	1	72879786+protectionsmachine...	72879786+protectionsmachine...
command_and_control_dns_query_to_suspicious_top_level_domain.toml in behavior/rules/windows	126	-	2024-07-10	2025-03-24	11	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_potential_shellcode_injection_via_node.js.toml in behavior/rules/windows	41	-	2024-07-29	2025-04-29	10	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_executable_file_extracted_to_temporary_directory.toml in behavior/rules/macos	56	-	2024-07-10	2025-02-20	10	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_kill_command_executed_from_binary_in_unusual_location.toml in behavior/rules/cross-platform	61	-	2024-09-18	2025-04-29	10	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_systemd_execution_followed_by_network_connection.toml in behavior/rules/linux	113	-	2024-09-18	2025-04-29	10	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_suspicious_windows_command_shell_execution.toml in behavior/rules/windows	144	-	2024-07-10	2025-03-24	10	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_suspicious_echo_execution.toml in behavior/rules/linux	165	-	2024-10-03	2025-04-29	10	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_potential_library_load_via_rop_gadgets.toml in behavior/rules/windows	57	-	2024-07-10	2025-04-29	9	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_amsi_or_wldp_bypass_via_memory_patching.toml in behavior/rules/windows	77	-	2024-07-10	2025-05-08	9	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_network_activity_from_a_stomped_module.toml in behavior/rules/windows	95	-	2024-07-10	2025-04-29	9	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_protected_process_light_bypass_via_dll_tampering.toml in behavior/rules/windows	101	-	2024-07-10	2025-04-29	9	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_remote_file_execution_via_msiexec.toml in behavior/rules/windows	105	-	2024-07-10	2025-03-24	9	1	72879786+protectionsmachine...	72879786+protectionsmachine...
command_and_control_network_connect_api_from_unbacked_memory.toml in behavior/rules/windows	115	-	2024-07-29	2025-02-20	9	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_suspicious_remote_process_suspend_activity.toml in behavior/rules/windows	142	-	2024-07-10	2025-02-04	9	1	72879786+protectionsmachine...	72879786+protectionsmachine...
yar Windows_Trojan_IcedID.yar in yara/rules	357	-	2022-07-29	2024-02-09	9	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
defense_evasion_chattr_execution_with_unusual_target_file.toml in behavior/rules/linux	71	-	2024-10-03	2025-02-20	8	1	72879786+protectionsmachine...	72879786+protectionsmachine...
discovery_external_ip_address_discovery_via_curl.toml in behavior/rules/macos	93	-	2024-07-29	2025-02-20	8	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_dylib_injection_via_process_environment_variables.toml in behavior/rules/macos	100	-	2024-07-10	2025-03-24	8	1	72879786+protectionsmachine...	72879786+protectionsmachine...
privilege_escalation_suspicious_impersonation_as_trusted_installer.toml in behavior/rules/windows	113	-	2024-07-10	2025-03-24	8	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_suspicious_powershell_execution.toml in behavior/rules/windows	179	-	2024-07-10	2025-03-24	8	1	72879786+protectionsmachine...	72879786+protectionsmachine...
yar Windows_Trojan_RedLineStealer.yar in yara/rules	200	-	2022-07-29	2024-05-08	8	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Generic.yar in yara/rules	316	-	2022-07-29	2024-03-21	8	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Generic_Threat.yar in yara/rules	3502	-	2024-01-12	2025-04-03	8	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_decoy_document_creation_via_curl.toml in behavior/rules/macos	41	-	2024-09-05	2025-02-20	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_linux_powershell_encoded_command.toml in behavior/rules/linux	48	-	2024-07-10	2025-02-20	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
credential_access_potential_credentials_phishing_via_osascript.toml in behavior/rules/macos	54	-	2024-07-10	2025-02-20	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
collection_sensitive_file_access_followed_by_compression.toml in behavior/rules/macos	55	-	2024-07-10	2025-04-29	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_ntdll_loaded_from_an_unusual_path.toml in behavior/rules/windows	55	-	2024-07-10	2025-01-21	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_execution_of_in_memory_file_via_interactive_session.toml in behavior/rules/linux	63	-	2024-07-10	2025-03-24	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_potential_proxy_execution_via_systemd_run.toml in behavior/rules/linux	70	-	2024-10-29	2025-04-29	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_reflective_dylib_load.toml in behavior/rules/macos	73	-	2024-07-10	2025-02-20	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_potential_persistence_via_direct_crontab_modification.toml in behavior/rules/cross-platform	81	-	2024-09-18	2025-04-29	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_udev_execution_followed_by_egress_network_connection.toml in behavior/rules/linux	86	-	2024-08-07	2025-04-29	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_suspicious_memory_protection_fluctuation.toml in behavior/rules/windows	87	-	2024-07-10	2025-04-29	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_suspicious_null_terminated_call_stack.toml in behavior/rules/windows	91	-	2024-07-10	2025-03-24	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_potential_evasion_with_hardware_breakpoints.toml in behavior/rules/windows	92	-	2024-07-10	2025-04-29	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_egress_network_connection_from_default_dpkg_directory.toml in behavior/rules/linux	96	-	2024-08-07	2025-04-29	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_suspicious_process_with_a_spoofed_parent.toml in behavior/rules/windows	102	-	2024-07-10	2025-03-24	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_suspicious_remote_memory_allocation.toml in behavior/rules/windows	103	-	2024-07-10	2025-04-29	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
privilege_escalation_potential_execution_via_token_theft.toml in behavior/rules/windows	110	-	2024-07-10	2025-02-20	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_potential_suspended_process_code_injection.toml in behavior/rules/windows	116	-	2024-07-10	2025-04-29	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_unusual_command_executed_by_web_server.toml in behavior/rules/linux	119	-	2025-01-21	2025-05-08	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_persistence_via_suspicious_launch_agent_or_launch_daemon.toml in behavior/rules/macos	128	-	2024-07-10	2025-01-13	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
credential_access_access_to_browser_credentials_from_suspicious_memory.toml in behavior/rules/windows	134	-	2024-07-10	2025-04-29	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...

Files With Most Contributors (Top 50)

Based on the number of unique email addresses found in commits.

See data for all files...

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
yar Windows_Trojan_IcedID.yar in yara/rules	357	-	2022-07-29	2024-02-09	9	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_RedLineStealer.yar in yara/rules	200	-	2022-07-29	2024-05-08	8	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Generic.yar in yara/rules	316	-	2022-07-29	2024-03-21	8	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_BruteRatel.yar in yara/rules	198	-	2022-07-29	2024-05-08	7	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Blister.yar in yara/rules	106	-	2022-07-29	2024-10-24	6	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Mirai.yar in yara/rules	1862	-	2022-07-29	2024-06-12	6	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Metasploit.yar in yara/rules	355	-	2022-07-29	2024-01-12	5	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_CobaltStrike.yar in yara/rules	1041	-	2022-07-29	2023-08-08	5	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Generic.yar in yara/rules	328	-	2022-07-29	2024-11-04	5	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Qbot.yar in yara/rules	132	-	2022-07-29	2024-02-22	5	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Smokeloader.yar in yara/rules	139	-	2022-07-29	2024-10-01	5	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_AgentTesla.yar in yara/rules	144	-	2022-07-29	2024-02-09	5	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
mock_ransomware.py in ransomware/testing	61	4	2024-07-22	2024-08-04	4	2	mark.mager@elastic.co	mark.mager@elastic.co
yar Windows_Trojan_Formbook.yar in yara/rules	65	-	2022-07-29	2024-02-09	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Donutloader.yar in yara/rules	56	-	2022-07-29	2024-02-09	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Cryptominer_Generic.yar in yara/rules	855	-	2022-07-29	2024-11-04	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Guloader.yar in yara/rules	68	-	2022-07-29	2024-02-09	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Gafgyt.yar in yara/rules	1392	-	2022-07-29	2024-06-12	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Hacktool_Earthworm.yar in yara/rules	57	-	2022-07-29	2025-02-05	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Shellcode_Generic.yar in yara/rules	54	-	2022-07-29	2023-06-13	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Rootkit_R77.yar in yara/rules	136	-	2022-07-29	2024-02-09	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_BPFDoor.yar in yara/rules	169	-	2022-07-29	2024-02-13	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Remcos.yar in yara/rules	48	-	2022-07-29	2024-02-09	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Ransomware_Snake.yar in yara/rules	45	-	2022-07-29	2025-02-05	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Sshdoor.yar in yara/rules	133	-	2022-07-29	2024-11-04	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Hacktool_Flooder.yar in yara/rules	607	-	2022-07-29	2023-10-23	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Netwire.yar in yara/rules	87	-	2022-07-29	2024-02-09	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Hacktool_Mimikatz.yar in yara/rules	170	-	2022-07-29	2023-06-13	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Xorddos.yar in yara/rules	453	-	2022-07-29	2024-11-04	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Emotet.yar in yara/rules	160	-	2022-07-29	2024-02-09	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Vidar.yar in yara/rules	110	-	2022-07-29	2024-10-24	4	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Deimos.yar in yara/rules	43	-	2022-07-29	2024-02-09	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Ransomware_Doppelpaymer.yar in yara/rules	61	-	2022-07-29	2023-01-30	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Azeela.yar in yara/rules	20	-	2022-07-29	2024-11-25	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar MacOS_Hacktool_Swiftbelt.yar in yara/rules	44	-	2022-07-29	2024-04-24	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_SystemBC.yar in yara/rules	48	-	2022-07-29	2024-05-08	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Wiper_HermeticWiper.yar in yara/rules	25	-	2022-07-29	2024-02-09	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Hawkeye.yar in yara/rules	47	-	2022-07-29	2023-04-24	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Ransomware_Cuba.yar in yara/rules	43	-	2022-07-29	2024-02-09	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Njrat.yar in yara/rules	43	-	2022-07-29	2023-06-13	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Exploit_Log4j.yar in yara/rules	25	-	2022-07-29	2024-02-13	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Bitrat.yar in yara/rules	42	-	2022-07-29	2022-09-29	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Merlin.yar in yara/rules	57	-	2022-07-29	2022-11-16	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Cryptominer_Generic.yar in yara/rules	38	-	2022-07-29	2024-06-12	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Tsunami.yar in yara/rules	512	-	2022-07-29	2024-06-12	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Dofloo.yar in yara/rules	57	-	2022-07-29	2022-11-16	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_CyberGate.yar in yara/rules	62	-	2022-07-29	2023-06-13	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_Bughatch.yar in yara/rules	50	-	2022-07-29	2024-02-09	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Linux_Trojan_Kaiji.yar in yara/rules	76	-	2022-07-29	2022-11-16	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...
yar Windows_Trojan_WhisperGate.yar in yara/rules	24	-	2022-07-29	2024-02-09	3	2	mika.ayenson@elastic.co	72879786+protectionsmachine...

Files With Least Contributors (Top 50)

Based on the number of unique email addresses found in commits.

See data for all files...

File	# lines	# units	created	last modified	# changes (days)	# contributors	first contributor	latest contributor
yar Windows_Generic_Threat.yar in yara/rules	3502	-	2024-01-12	2025-04-03	8	1	72879786+protectionsmachine...	72879786+protectionsmachine...
lua artifact.lua in ransomware	3044	66	2023-02-16	2023-02-16	1	1	88641171+ayfaouzi@users.nor...	88641171+ayfaouzi@users.nor...
yar Windows_Generic_MalCert.yar in yara/rules	2224	-	2025-02-11	2025-04-03	3	1	72879786+protectionsmachine...	72879786+protectionsmachine...
yar Linux_Generic_Threat.yar in yara/rules	1174	-	2024-02-13	2024-06-12	2	1	72879786+protectionsmachine...	72879786+protectionsmachine...
yar Linux_Trojan_Metasploit.yar in yara/rules	425	-	2024-06-12	2024-06-12	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
lateral_movement_suspicious_process_execution_via_network_logon.toml in behavior/rules/windows	356	-	2024-07-10	2025-05-02	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
yar Windows_Hacktool_WinPEAS_ng.yar in yara/rules	340	-	2023-02-01	2023-02-01	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_network_module_loaded_from_suspicious_unbacked_memory.toml in behavior/rules/windows	249	-	2024-07-10	2025-04-29	16	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_shellcode_api_behavior_from_a_signed_module.toml in behavior/rules/windows	248	-	2025-03-04	2025-03-24	2	1	72879786+protectionsmachine...	72879786+protectionsmachine...
command_and_control_connection_to_webservice_by_a_signed_binary_proxy.toml in behavior/rules/windows	231	-	2024-07-10	2025-04-29	12	1	72879786+protectionsmachine...	72879786+protectionsmachine...
command_and_control_suspicious_dns_query_from_mounted_virtual_disk.toml in behavior/rules/windows	225	-	2024-07-10	2024-11-28	4	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_binary_masquerading_via_untrusted_path.toml in behavior/rules/windows	214	-	2024-07-10	2025-04-29	5	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_initial_access_via_macos_installer_package.toml in behavior/rules/macos	202	-	2024-07-10	2025-01-13	4	1	72879786+protectionsmachine...	72879786+protectionsmachine...
privilege_escalation_suspicious_execution_via_windows_services.toml in behavior/rules/windows	200	-	2024-07-10	2025-01-13	3	1	72879786+protectionsmachine...	72879786+protectionsmachine...
initial_access_suspicious_registry_modification_via_wmi.toml in behavior/rules/windows	197	-	2024-07-10	2024-09-18	2	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_remote_memory_write_to_trusted_target_process.toml in behavior/rules/windows	195	-	2025-02-04	2025-04-29	3	1	72879786+protectionsmachine...	72879786+protectionsmachine...
command_and_control_connection_to_webservice_by_an_unsigned_binary.toml in behavior/rules/windows	193	-	2024-07-10	2025-02-04	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_execution_from_unusual_directory.toml in behavior/rules/windows	189	-	2024-07-10	2025-04-29	5	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_process_memory_write_to_a_non_child_process.toml in behavior/rules/windows	184	-	2025-02-04	2025-04-29	3	1	72879786+protectionsmachine...	72879786+protectionsmachine...
lateral_movement_execution_of_a_file_dropped_from_smb_via_services.toml in behavior/rules/windows	181	-	2025-01-21	2025-04-29	2	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_suspicious_powershell_execution.toml in behavior/rules/windows	179	-	2024-07-10	2025-03-24	8	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_remote_process_memory_write_by_low_reputation_module.toml in behavior/rules/windows	177	-	2025-02-20	2025-04-29	3	1	72879786+protectionsmachine...	72879786+protectionsmachine...
yar Linux_Rootkit_Generic.yar in yara/rules	177	-	2024-11-25	2024-12-12	2	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_untrusted_dll_loaded_by_a_persistent_program.toml in behavior/rules/windows	175	-	2024-07-10	2024-07-10	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_suspicious_windows_component_object_model_via_dllhost.toml in behavior/rules/windows	172	-	2024-07-10	2024-07-10	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
lateral_movement_execution_of_a_file_dropped_from_smb.toml in behavior/rules/windows	172	-	2024-07-10	2025-03-24	5	1	72879786+protectionsmachine...	72879786+protectionsmachine...
initial_access_initial_access_or_execution_via_microsoft_office_application.toml in behavior/rules/macos	172	-	2024-07-10	2025-01-13	4	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_suspicious_execution_via_dcom.toml in behavior/rules/windows	171	-	2024-07-10	2024-11-28	3	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_suspicious_windows_schedule_child_process.toml in behavior/rules/windows	167	-	2024-07-10	2025-02-20	2	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_suspicious_echo_execution.toml in behavior/rules/linux	165	-	2024-10-03	2025-04-29	10	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_scheduled_task_creation_by_an_unusual_process.toml in behavior/rules/windows	160	-	2024-07-10	2025-02-20	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
credential_access_failed_access_attempt_to_web_browser_files.toml in behavior/rules/windows	157	-	2024-07-10	2025-03-04	5	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_rundll32_with_unusual_arguments.toml in behavior/rules/windows	156	-	2024-07-10	2024-10-03	3	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_parent_process_pid_spoofing.toml in behavior/rules/windows	148	-	2024-07-10	2025-04-29	6	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_suspicious_string_value_written_to_registry_run_key.toml in behavior/rules/windows	146	-	2024-07-10	2024-11-28	3	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_suspicious_windows_command_shell_execution.toml in behavior/rules/windows	144	-	2024-07-10	2025-03-24	10	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_suspicious_remote_process_suspend_activity.toml in behavior/rules/windows	142	-	2024-07-10	2025-02-04	9	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_registry_run_key_modified_by_unusual_process.toml in behavior/rules/windows	142	-	2024-07-10	2024-07-10	1	1	72879786+protectionsmachine...	72879786+protectionsmachine...
yar Windows_Trojan_GhostPulse.yar in yara/rules	141	-	2023-10-26	2024-10-24	6	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_unsigned_dll_from_suspicious_directory.toml in behavior/rules/windows	140	-	2024-07-10	2024-10-03	2	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_unusual_powershell_engine_imageload.toml in behavior/rules/windows	139	-	2024-07-10	2024-10-03	2	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_unbacked_shellcode_from_unsigned_module.toml in behavior/rules/windows	138	-	2024-12-11	2025-04-29	6	1	72879786+protectionsmachine...	72879786+protectionsmachine...
discovery_suspicious_security_product_enumeration.toml in behavior/rules/windows	136	-	2024-09-18	2025-03-24	6	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_registry_or_file_modification_from_suspicious_memory.toml in behavior/rules/windows	135	-	2024-07-10	2025-04-29	3	1	72879786+protectionsmachine...	72879786+protectionsmachine...
credential_access_access_to_browser_credentials_from_suspicious_memory.toml in behavior/rules/windows	134	-	2024-07-10	2025-04-29	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...
yar Windows_Trojan_Rhadamanthys.yar in yara/rules	132	-	2023-04-24	2025-04-03	5	1	72879786+protectionsmachine...	72879786+protectionsmachine...
yar Multi_Ransomware_BlackCat.yar in yara/rules	129	-	2022-08-16	2024-08-22	6	1	72879786+protectionsmachine...	72879786+protectionsmachine...
defense_evasion_windows_console_execution_from_unbacked_memory.toml in behavior/rules/windows	128	-	2024-07-10	2025-02-20	5	1	72879786+protectionsmachine...	72879786+protectionsmachine...
execution_suspicious_powershell_execution_via_windows_scripts.toml in behavior/rules/windows	128	-	2024-07-10	2025-02-20	5	1	72879786+protectionsmachine...	72879786+protectionsmachine...
persistence_persistence_via_suspicious_launch_agent_or_launch_daemon.toml in behavior/rules/macos	128	-	2024-07-10	2025-01-13	7	1	72879786+protectionsmachine...	72879786+protectionsmachine...